For some, going to the government 1st may be the right thing. For others, who don't trust the Federal Government maybe not. But I don't see any obligation.
If he had gone to the government first he would have been told to keep his mouth shut on pain of arrest and imprisonment or worse and the government would then have ignored his information. What the public doesn’t know won’t hurt the government.
“Chris Roberts of the Colorado-based One World Labs, a security intelligence firm that identifies risks before they’re exploited”
This is what the guy does for a living. It’s his job to go to the authorities 1st.
“One World Labs is a security intelligence firm that identifies risks before they’re exploited.
We offer access to the world’s largest database of dark content and provide comprehensive assessment and consulting services to protect corporations, government and non-profit organizations.”