Should we be reverse engineering mobile banking apps to help them, or leave them alone?

Financial apps often have terrible security, but unsolicited vulnerability reports to banks can land you in legal hot water depending on jurisdiction. How do you balance responsible disclosure with self-preservation when the target might lawyer up instead of patching?