> Now imagine you figure out how to do the hack, do all the preparation, and sell it ready to use to somebody.

Now imagine you notify the vendor that they have a grave security flaw in their product. They could totally turn you in to the police and the PoC is sufficient to consider you guilty. You won't be able to prove yourself innocent without a long, expensive and life-destroying legal battle.

It would have a massive chilling effect on everything else instead of what you originally intended.