It doesn't handle liability, and really nothing does other than the company in question doing the right thing (e.g. running a bug bounty via a well known third

It doesn't handle liability, and really nothing does other than the company in question doing the right thing (e.g. running a bug bounty via a well known third party and signing legal docs, or making public statements backed with documents. Also Occams razor, a lot of websites are hell to navigate and find the security reporting contact information. Why not make it super easy?