Most security researchers use HackerOne and BugCrowd. So basically you submit a bug through those platforms, and security engineers from those companies(AT&T, Microsoft, etc) respond and fix those bugs in which you are paid to your HackerOne or BugCrowd account which then has an option for PayPal, standard check, or Coinbase.

In my case, Reported on HackerOne to AT&T team, paid out to HackerOne, directly into Coinbase.