[tinco]

Exactly, even more it would be great publicity, at least to pentesters, if Hackerone would investigate one of these reports and publicly reprimand or even disqualify a site like PornHub.

But pentesters are not the ones paying for a HackerOne listing, those would be the companies, and perhaps the companies might not be so happy if HackerOne would publicly shame some of them.