No, that's not an alternative avenue for reporting serious issues, because that only applies to "material breaches" (i.e. the vulnerability was not only exploit

No, that's not an alternative avenue for reporting serious issues, because that only applies to "material breaches" (i.e. the vulnerability was not only exploitable but actually exploited, and the attack did damage, and the damage is so large that it makes a difference to the financials of the company) so someone has to commit a bunch of felonies before the issue becomes reportable to SEC, and reporting it is not a magic get-out-of-jail-free card. And if some script kiddie in a VDP says "pay me or I'll actually exploit the vulnerability so that it'll be a material breach", well, just sending that message is attempted extortion right there, threatening to commit a felony.