"The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied."

That seems like a pretty substantial claim to make without any sort of "in [country/state/province/etc.]" qualification, let alone a reference.