There is or was a cash bug bounty.
And even if not, the motivation is building a reputation as a security “expert”.