There's a "be careful what you wish for" argument here, because my understanding is that the FAANG vendors are snapping up security people just as fast as they possibly can, and, again, ceteris paribus you'd rather have those people working on the actual most serious vulnerabilities rather than the ones causing the noisiest bounty drama. But you could reasonably go either way on this I guess.

The degree of damage done by particular vulnerabilities is different from person to person. For one individual losing their contact database to some un-identified third party might be a 'meh' event, for another it could be a disaster.