Reading this article I’m left wondering why it’s considered socially acceptable for a security researcher to frequently open reports against open source softwar

Reading this article I’m left wondering why it’s considered socially acceptable for a security researcher to frequently open reports against open source software projects without accompanying those reports with a diff fixing the vulnerability? Maybe we should start expecting accompanying patches as a “proof of work” scheme for CVEs? I understand that finding vulnerabilities is a different skillset than fixing them, but as Offensive Security says: “Try Harder”