I mean point 3 is a big part of this value wise. By getting certified bounty-paid vulnerabilities in a big name product like google, they can then go on and get

I mean point 3 is a big part of this value wise. By getting certified bounty-paid vulnerabilities in a big name product like google, they can then go on and get lucrative security contracts ("we hired a guy that has found bugs in google's products"). Also left unsaid is that these are products that people's grandparents use. So there is some very white-hat "help the public good" here. Even if it's also to the for-profit benefit of a mega corp. That's an issue for anti-trust courts, not people trying to make the world better (people use these products right now, that's the status quo; either it can be fixed now, or it can be part of a likely ineffectual protest that only harms others).