I’m not a security researcher but I disagree with this rationale on a number of levels. First, just intuitively it feels wrong. It’s like saying that if you ne

I’m not a security researcher but I disagree with this rationale on a number of levels. First, just intuitively it feels wrong. It’s like saying that if you need a $20 permit for camping, but if you get caught camping illegally the fine should only be as much as the permit. Clearly it should be more. More specific issues: - Who determines how long the hack took? - A security researcher is guaranteed the $350/hour whether or not they find the exploit. The bug hunter only gets paid if they find an exploit. Thus, if you follow this out logically every bug hunter should really just be a contracted security researcher and the only bugs being uncovered would be the ones companies were paying upfront to find. In other words, freelance bug hunting is deincentivized.