I did some lazy searching and it seems it's a well known fact. I don't think the author has to back it up in this case.

Infosec researchers say Apple’s bug-bounty program needs work[0]

[0] https://arstechnica.com/information-technology/2021/09/infos...