I think there are simply very few humans performing competent vulnerability research (proactive discovery, not reactive patching) in public.