They can't easily get jobs that pay them well, the way most programmers in the West can. People really good at security in the US just get a job making a great salary.
Its also more dangerous in the US. Since the majority of major web apps are hosted in the US, if you're in the US it is easy for the app's owners to go after you legally. It gets much more complicated if you're in another country. For example, if weev had been in eastern Europe, it would make it much more difficult for ATT to go after him.
You don't even have to be 'good at security' to get a job making great salary - just a clearance and maybe a certification or two.