Yes but sadly that's not what happens.

For example there was a security researcher that found out, the official api of some political party site here in Germany was leaking user data. Instead of thanking them an mitigating the issue, the researcher got sued and it was just dropped because of the public outcry.