I'll cite an example that came to my mind to crisply explain the essence of my question. It might contain some extreme assumptions not rooted in real world examples.
Computer scientist John Doe who is working on his own pet project detects a vulnerability in a mobile hardware related to fingerprint storage while analyzing bunch of social media posts. He found that whenever a user posts something from their popular social media application, the device adds some data to that post that leaks the information related to their fingerprint. Anyone with fair technical understanding can then reproduce the fingerprint from such posts. These fingerprints are the gatekeepers to all the funds that are stored by the users on their devices.
John Doe is now in a dilemma (legal not ethical). He is uncertain whether revealing this vulnerability publicly is legal or he should do it discreetly to the manufacturer. This smartphone manufacturer has 40% of the market share and this public revealing might lead to loss of funds for all the users who have used this fingerprint storage option.