they have a bug bounty program, they do pay, they have the SDR program, etc.

does this show conviction or it's just basic prevention of brand damage?

could they do more? of course.

can any company stand up to Trump? unlikely.