> There are few things more frustrating than dealing with a vendor that doesn't understand this.

I think they do understand this very well; they just want to brainwash people into thinking it's a civic duty to do what they say. It's not. Ethical security researchers' responsibility is to the users, not to the vendors.