There is or was a cash bug bounty.

And even if not, the motivation is building a reputation as a security “expert”.