Some researchers believe they are getting the shaft from software developers who don't pay the flaw finders.