The term researcher implicitly narrows which reporters this spec applies to (even if this is not the intent). For example, a developer discovering a vulnerability while simply using software might not feel like they're in scope of this spec as they're not conducting research.