One of our most prolific bug bounty hunters did exactly that. And what is even more impressive / exotic is how he finds the bugs. With "just" a browser and very little Burping.
Anecdotical, but it happens.
Anecdotical, but it happens.
Where I agree most bugs are self inflicted, there are plenty found in acquired software too.