Well, the users of the system should be able to recoup some of their costs for services (security) not rendered and then pay the researcher for that. In a more well-coordinated society none of this would happen because the company would have avoided the predictable outcome by hiring a security person in the first place.