I think they just don't care.

Their SECURITY.md mentions bug bounties, yet if your submission has anything to do with GitHub it's immediately disqualified. They refuse to remove that (in my opinion) misleading language.

https://github.com/microsoft/.github/blob/main/SECURITY.md