You'd be surprised! Some of the best smart contract security folks in the space are pseudonymous and I imagine many organizations would work with them without needing to know their legal identity. One of those people is samczsun[1] who, amongst other things, famously prevented a potential ~$350m hack.