I'll be curious to hear what your panel of ordinary Google users has to say, tedster. The people that I've talked to have appreciated it.
"Don't you think that simply removing the site from search results would get their immediate attention?"
You would think, but people who don't patch their servers are often the sort that don't notice if they're not in the search results. Another problem is that site owners wouldn't know why they weren't showing up.
In fact, your proposal was the previous approach that we were using. At the same time, we would leave a message in the webmaster console and often try to email the site using email addresses that we could find on the site. What we found was that we weren't reaching the site owner as often as we wanted to. Many sites remained hacked for days, weeks, even months despite our best efforts to alert the sites through other methods.