They don't even have to work for US companies. As a recent example, the Dirty Pipe vulnerability was discovered by a German Engineer working for a very basic website hoster.

He found it when he was investigating a customer complaint about corrupted log file downloads.

There is still in-depth high-value engineering happening, even if you don't work for the flashy silicon valley VC unicorns.

In fact, such a basic support request would probably have been closed as "could not reproduce" in a highly competitive environment.