Most people use Chrome with default settings, maybe with some extra AV as well. These websites are going to get added to the list anyway.

Perhaps a coordinated attempt with CERTs or a basic attempt at email contact would be a good idea, but if emails are nowhere to be seen and there is no way to determine a relevant taskforce, reporting the domains seems like the obvious problem.

Getting blocklisted sucks, but so does identity theft, drive-by malware, and credit card fraud. Without things like SECURITY.txt or contact email addresses, there's not a lot more you can do to prevent these people from (unwittingly? intentionally?) spreading harm.