One's billing rate is determined by the market value of one's services. For instance, I may be able to charge $300/hr for general security consulting to a software vendor, but I cannot expect $300/hr for flipping burgers at a fast food place. It's contextual; there's not one price assigned to one person. If Charlie finds an exploit that could potentially cause a lot of damage, it's perfectly reasonable to expect the vendor to pay a value proportionate to that exploit's potential liability, damages, etc.

Hourly rates are determined based on market rates, and vary from job to job.