Just one example, reneging on bug bounties is mind-blowingly stupid for a $3T company. Security researchers will sell what they find to the likes of NSO Pegasus instead of Apple. Also, the bad blood thus created makes them less likely to follow "responsible disclosure" and instead just disclose them as soon as discovered for kudos.