>If I hire a normal security consultant, and she finds an issue in my product that I don't agree is a real vulnerability, it's absolutely not fine for her to go write a public article about it.

The difference is that you pay her either way. HackerOne doesn't. If HackerOne wants the advantages of paid employees then they need to pay for employees and not mask it as a bug bounty program.