This seems like a good idea. I don’t know that anyone would ever need to notify me, but I went ahead and created a security.txt anyway. It complements my robots.txt and humans.txt.