it's a bit more complicated than that, though - it's not that the same people who would have found and reported vulnerabilities to yahoo if they were properly i

it's a bit more complicated than that, though - it's not that the same people who would have found and reported vulnerabilities to yahoo if they were properly incentivised will instead turn around and sell them to the highest bidder. the black-hats will always get a higher reward from other criminals than they will from the companies; the point is that if you can also get a white-hat to report stuff to you, you can perhaps fix it before the criminals exploit it. in the absence of incentives, the danger is that the white-hats will simply not bother with you. and yes, people lose, but you cannot really lay a moral responsibility on people to help a profit-making company out for free just because if they don't other people might get hurt.