[csmatt]

Not at all similar to that. Ignoring the fact that the characteristics of residences and a very high traffic website with an enormous user-base are vastly different, your argument relies on the discoverer of the vulnerability choosing one of two paths: get paid by the company or get paid by nefarious people.

A third option is to choose neither because the discoverer doesn't think it warrants his or her time to report it. Reporting a security vulnerability requires more than just sending an email. Meanwhile, others who have discovered the same vulnerability may be selling access to it and a company like Yahoo has no idea until severe damage has been done.

[spullara]

Assuming they spent effort to discover the vulnerability the idea that there is a 3rd option where it is suddenly not worth their time to report it makes little sense.