DoJ says its policy will encourage independent security and safety research, but will large AI companies follow suit in encouraging vulnerability disclosure?