I would go with this assumption. Best to assume neglect over mal intent.

This behavior was seen before too with the devs behind the new Gmod in Source 2 (Alyx engine). They spent months trying to get in touch with access and it came down to an employee who ended up getting fired for neglecting responsibilities. Now everything seems to be working out and open tooling is being developed.

Does it really make a difference, with respect to whether they should be kicked off HackerOne? Incompetence and disorganization is no excuse for what is essentially (if not literally) wage theft.