You are correct because they have now added a bullet point: > Vulnerabilities found with an SRD are automatically considered for reward through the Apple Secur

You are correct because they have now added a bullet point: > Vulnerabilities found with an SRD are automatically considered for reward through the Apple Security Bounty.