Companies don't generally send out notifications like this for bug bounty reports or pentesting engagements - kind of implies that they found it being exploited

Companies don't generally send out notifications like this for bug bounty reports or pentesting engagements - kind of implies that they found it being exploited in the wild.