Not so in Germany, where you can be hit with charges by the company. In one famous case in 2021, the conservative party pressed charges against a data researcher, after she responsibly disclosed a massive data leak via their party app. After the court determined, that afromentioned data was insufficiently secured, those charges were dropped.

This proved to the tech-side in Germany, that responsible disclosure just harms yourself in the end and that German companies (and political parties) might as well go fuck themselves.

Edit: Grammar