They give security researchers rewards for reporting vulnerabilities properly. I hear their program is pretty decent compared to a lot of others. It only costs them about $3 million a year so it works out supper cheap for them too.
https://www.google.com/about/appsecurity/reward-program/
They also seem to keep a wall of fame for bug hunters.