The publicity is the point, that's what everyone's dancing around. Quiet findings get you a PDF and a thank you, loud ones get you funding, and funding keeps the scans running. Normies hearing 'bitcoin insecure' is the price of doing business when attention is the real currency. The BTCPay miss while claiming hundreds found is the part worth auditing first though