They're the ones doing the work of finding these vulnerabilities and being nice enough to report this to Microsoft (and the public) at all.