Welcome to the conundrum of the security business and why it is more profitable to be a bad guy than a good.
Remember this about "getting sued"... Anyone can sue anyone - even if there is nothing justified to sue over. If an entity has money to sue the entity that doesn't have money to fight it looses, almost automatically. 50% of the time or more, if you get sued for some of these things, you are also having to fight off state or federal (or your country's equivalent) criminal or regulatory authorities at the same time.
This is why insecurity will always reign, and why I am sure no one wants any of it fixed.
Here in the US, if you even inadvertently find an issue and report it to a product owner you could be facing their civil (sue) wrath, you could be facing DMCA and others. What do I mean by inadvertently? I could be debugging what I think is an issue with my local machine acting wonky and decompile, or source code from a 3rd party (where I find the problem). Now remember, they are causing the problem to MY machine and I am trying to figure it out... As soon as I find it, and report it, I could be in this grey area.
And I am not even "hacking" per se.
So the rules have been written badly and poorly to really allow for public disclosure. I think that is why organizations that want bugs and security concerns to be found have create very open and clear "bug bounty" programs and do so with a very "open kimono" approach.
What I have seen work in absence of those, is to do what a lot of researchers do... set up anonymous accounts that you can report the information to the organizations to, and don't take credit for it until well after it has been taken care of - I guess that is unless you are hacking Facebook. Seems like everyone is in Facebook's face hacking it aggressively and publicly :).