Microsoft does already, its the MSRC, but they take a different approach to disclosure: https://www.microsoft.com/en-us/msrc/cvd