Idunno, I think this model of disclosure feels more natural to me. The "coordinated" model can have the smack of extortion to it.

And yes, I very much want there to exist people whose specialty is finding security bugs. I wouldn't expect such a person to be a diehard contributor to any particular project. Their motivation isn't making one tool better, but keeping users safe. We need those people and the work they do badly!