Companies just don't use HackerOne in that case and HackerOne is dead. Which is why they are beholden to the companies in question