Why does informing software companies of vulnerabilities open you up to litigation?

I’m watching a documentary and it says that “ethical” hackers were reporting vulnerabilities to large software companies and it bit them back, lawsuits created. So they stopped reporting directly and instead posted on private forums or sold the vulnerability to the highest bidder (usually to companies that inform clients of the vulnerability at a cost or to undisclosed parties)

So essentially the software companies, instead of being thankful, created a very lucrative industry where some really bad people can purchase …

back companies cybersecurity ethical forums hackers large lawsuits litigation private reporting software software companies vulnerabilities vulnerability