Nobody is going to avoid hiring a security consultancy that posts bugs with a coordinated timeline that notes they didn't engage with the bounty program.