They've always used external pens, but through contracts. This seems to be more like an "open" bug bounty program which just requires prior vetting for obvious reasons.