Oh great, now the previously lazy companies will pressure researchers to "not have discovered" bugs due to the legislatively required response to anything put into the system formally... and we will start hearing, "I don't use open source because it involves triage of too many CVEs. Michaelsoft never gives my engineers mandatory work."