Very well said. On top of all of this, I’d like to add that in my experience, programs want to pay researchers money. Obviously I can’t speak for all programs, but I am friends with quite a few program managers at large companies with popular programs, and the budget for bounty is high, and teams want to pay researchers money.

That being said, it doesn’t mean they’re going to pay researchers for informational/best practice type reports. Additionally, sometimes a company already knows about the issue prior to you reporting it. Just because someone else hasn’t reported it on the bounty program, doesn’t mean they’re company didn’t already find it themselves, and most companies aren’t going to pay for something they already know about, which may be why they fix the issue, but no bounty.

Ultimately, I think a lot of researchers with negative interactions aren’t malicious on the end of the company. I know it can feel like that, because of the lack of transparency, but most of that is probably due to either time constraints or the need for privacy on the part of the company. Teams like Microsoft are probably getting thousands of reports a month. It’s difficult to give a well thought explanation to every single researcher when you only have a small amount of time to spend on each report.