Yes, but also there is also a huge value to individual contributors and their careers. I broke into the field after landing a few relatively high profile CVE acknowledgements for big companies. Responsible disclosure is good for your career.

On the other hand, if the value of that drops you can expect to see some folks start taking the wrong path.