[chipdart]

> (...) as these Internet security companies are mostly legitimate.

Note that you're basing your assertion on the motivation of random third parties exclusively on the fact that they exist and they are behind active searches for vulnerabilities.