Roughly similar to a guy that walks through your neighborhood jiggling door knobs and asks for $100/house when he discovers an unlocked door or disabled alarm system otherwise he will report it to his burglar friends.
A third option is to choose neither because the discoverer doesn't think it warrants his or her time to report it. Reporting a security vulnerability requires more than just sending an email. Meanwhile, others who have discovered the same vulnerability may be selling access to it and a company like Yahoo has no idea until severe damage has been done.