If they want the best security, they should have a bounty program both internally and externally. Of course, one would expect the Tesla engineers to find bugs first, as they have earlier and closer access to the system. Such bug/exploit finding should be appropriately rewarded. But the closer you are working with a product, the more obvious things one might miss. I often miss bugs in my own code, while I am great at finding them in my coworkers code :). So external bounty programs attrackt a wide variety of clever people with an idependant mindset.