If a person discovers a vulnerability similar in scope to the recently disclosed Spectre/Meltdown (CPU design flaws that affect nearly all existing server infrastructure), could they legally explain this vulnerability to the vendor and offer non-disclosure for a fee, in the realm of $100,000 per month of delayed publication?
Failure to pay only results in immediate publication of the vulnerability, which is in itself a legal activity.
Would this be construed as extortion? The design flaw itself exists already, and information regarding it isn't withheld from the vender, they are paying solely for delayed disclosure to the public.