> Most people would even shut the door if they weren't around. Same principle.

This is a poor example because finding bugs requires a lot more effort than giving a door a push (which I find a little spurious - I wouldn't touch my neighbours' car).

There is in practice an almost infinite amount of things you can donate time to and all else being equal (for example, they're all password managers) I doubt you'll convince most people by telling them they should do it because "it makes things better for everyone", they could be making everything better for everyone and still getting paid - that's the superior option. Even if I think you are correct.

That's not a fair use of word "pay". I get where you are coming from but it's obvious what he means and feels manipulative to use it that way.

I appreciate that they have a good way of contacting them with security issues, and if I found any by accident or used to tool daily myself I might report stuff. However, I will not dedicate time hacking something I do not use myself, to report stuff for free.

Sure but we wouldn't go out looking for open doors. If you want me to patrol then you need to pay me.