> I have found several security vulnerabilities that I have never reported to the company

There's no problem with that. Anyone who does report anything is doing them a favor. Which they often repay with lawsuits.