They don't even have to work for US companies. As a recent example, the Dirty Pipe vulnerability was discovered by a German Engineer working for a very basic we

They don't even have to work for US companies. As a recent example, the Dirty Pipe vulnerability was discovered by a German Engineer working for a very basic website hoster. He found it when he was investigating a customer complaint about corrupted log file downloads. There is still in-depth high-value engineering happening, even if you don't work for the flashy silicon valley VC unicorns. In fact, such a basic support request would probably have been closed as "could not reproduce" in a highly competitive environment.