That's possible, and also for the SMB market that's producing lots of software but might be just a few devs. Think: iphone, ipad apps, small sites. There's not much for them either.
Another possible angle - as Thomas points out, researchers with "reputation" don't need this.
But what about up and coming researchers? Where do they "earn their rep" in the current system? I could see this maybe taking off as a way for not-yet-reputable researchers to document their history/trackrecord, in much the same way as developers can use their github repos as documentation of their programming history. Maybe in a few years time we might see junior security researchers listing their Vularb account on their resumes...
'Up and coming' Researchers generally improve their reputation by schmoozing journalists, doing conferences and so on. If for example, you didn't want to do through someone like ZDI you could just post the bug to full disclosure. If it's a big enough bug, then the media will come to you.
Unfortunately in this industry 'rep' isn't earned, it's about who shouts the loudest, and it leads to some uncomfortable situations.
