This may be the way now, since in the late aughts / early 2010s large institutions started reporting white hats for cybercrime and suing them rather pay the vulnerability bounty, creating a golden age of black hatring circa 2015 that Russian and Chinese states exploited.

This is what we get for NSA turning into a SIGINT service rather than a COMSEC service. The US State willfully made this bed with pre-infected sheets.