They are also incentivized to find high severity vulnerabilities - and/or to announce found vulnerabilities as high severity.

After all, what would all that hardware and research be worth it, if it didn't find the most critical vulnerabilities around?