There's no obligation, it works as a deterrent for publishing the vulnerability to potentially bad people. Many tech companies now offer a reward for submitting

There's no obligation, it works as a deterrent for publishing the vulnerability to potentially bad people. Many tech companies now offer a reward for submitting vulnerabilities, it's more often than not cheaper than being exposed.