It may not directly pay but his reputation as Security Expert is enhanced.

I don't know if "Big Internet" (ICANN, IANA, IETF, RIRs) does not have its own security group like the Commercial companies do (Project Zero, various EH companies). RFC3013???

We have to depend on people who can take time to look for exploits in exchange for reputation.