Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply don't disclose the bug and keep it private. The problem stays open.
However, the vendor does sell their product to possibly hundreds of customers who are vulnerable to the bug, who definitely don't want to stay vulnerable, since they could potentially suffer significant financial losses if someone else found the bug and used it to steal information, or worse.
What are the legal and ethical arguments for reaching out to the vendor's customers, informing them that the bug exists, explaining their potential losses (six figures), and using that as leverage to get the vendor to find the bug on their own (if they can), or pay you your desired bug bounty?
As long as the bug really does exist and you're not scaring customers for nothing, and the vendor is more than capable of finding the bug on their own if they're not willing to pay you for it's disclosure, would this be wrong to do? The alternative option of leaving the bug alone and keeping all customers vulnerable, doesn't seem like a very ethical option either, though in the short-term it creates less problems for the vendor.
Any advice would be appreciated.