Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead.
The amount of work doing something like this is orders of magnitude more than the compensation:
1) Most security vulnerabilities investigated lead nowhere, were previously discovered, etc. That's lost time.
2) Working out something like this is much more than 0.25-3 weeks.
More critically, the black market value of most vulnerabilities is much more than Google pays out. A rational economic actor would sell something like this grey market or black market, rather than reporting.
The problem is none of the big companies take security seriously. The reason is that there are no economic damages to even serious data leaks, so what incentive is there for them to take data security seriously?
Many companies (including big ones like T-Mobile) have major security compromises every few months (and in the case of T-Mobile, have had so for decades) and simply don't care. I don't mean to pick on T-Mobile -- I like them as a company -- but they're pretty representative.