Most people who are doing this type of things offer consulting services to help make sure your site / app are secure.

> The best approach is not to do it.

Don't do what? Don't tell them there is a security problem?

> Demanding money from someone that didn't hire you is never ethical - just childish.

Lets say my front door is open. Someone takes a picture of it and sends it to me so I can close and lock it. Once it is closed, they explain that they offer a service where they will help homeowners make sure that they keep their doors closed. They plan to use the picture they took to illustrate how they help identify open doors to show why people might want to be their client. However, if I want to pay them for the service the provided, then I get to decide if and how any information about my door being open is used.