I wonder if legal obligations surrounding responsible disclosure and treatment of security researchers should be brought in. GDPR-sized fines for treatment like

I wonder if legal obligations surrounding responsible disclosure and treatment of security researchers should be brought in. GDPR-sized fines for treatment like this, as well as negligence in fixing reported vulnerabilities, could go a long way to improving the lives of security researchers wrt security of their livelihood, and improve the security of the digital world for all of us.