Most vulnerability reports I see at work come from security researchers in Pakistan and India.

I have never found out if this is a side gig, a full-time job, or a hobby for people.