That's why companies that don't pay and even sometimes prosecute white hats basically paint a giant target on their backs. All they've accomplished is ensuring that future security practices will be worse and they'll be less secure.

I keep telling people the only solution is to get rid of the but nobody listens..