I’m guessing you clients pay you for your time, so perhaps spend some of that paid time on creating a pull request… or pay somebody to do it. Like you, most people like to help out a fellow volunteer, or get paid to help somebody else who is paid. That seems fair, right? It’s either business, or it’s not.
I do not know how I should make a pull request.
In the past I have informed NC about things that I found, and they repaired those in the next release. That is why I have explained what is going wrong, why and where.
I do not fine our clients for those things and the research I do. That is my contribution as volonteer to the NC org. Most clients that use NC with us are local organisations, groups and local political parties. They have all small budgets and we respect that. For other business clients we have Synology NAS systems that we manage.