This is BS. People want the list. End the gate-keeping.

You could send an interview request to their technical staff with an assignment that injects the fix into their production environment.

I suspect that these problems exist everywhere at this moment in all major systems.

Perhaps a bot to attempt to make contact and alert the staff.

You wont report them or tell them... because it's not a bug it's a feature. The "moral and trustable" big names that hold the doors of the internet could stop you from going to any scam/infested site but they wont... chrome can and actually worked against things that can prevent you from getting there in first place like ublock origin. Things are working as intended... as long as someone is doing money you can basically steal, intercept, and gate what people do (looking at you postman).

I like to imagine a rogue good-samaritan will hack these websites to apply security fixes before logging out.

It's too bad that such a person would likely end up arrested if they don't mask their identity.

Just publish the URLs, duh. Are they trying to keep it secret so they can sell their threat intelligence product?

Do it in the most humiliating manner possible. Inform them through email and give them a few days before posting it publicly. You will find that one cares.

DIY - hack'em, patch'em, and gtfo.

How about you post a search and site owners can find themselves.

Predictable. When I was doing this work full time greater than 90% of the code came from outside the organization, such as NPM packages or framework plugins, and nobody reviewed the third party code. Nobody wanted to own the hard problems like security, accessibility, or performance. They just wanted to put text on the screen with JSX and call themselves experts.

Over the years I've found so many Fortune 500's with either massive bugs that broke the site for customers, or huge security holes, and spent hours trying to find a way to report it to them, to no avail. The people who make these websites just don't give a shit. So I now just look up WHOIS and email the domain's contacts and give up.