Anyone finding a vulnerability now should really be submitting it to a broker instead of the company. Brokers pay way more for good exploits than the big guys (Google/MS/Amazon/etc) and won’t just refuse to pay claiming you found an undocumented feature.

Apparently Google doesn’t care about good PR anymore.

https://en.wikipedia.org/wiki/Don't_be_evil

Don’t Be Evil.
They have fully embraced it now.