Unless med companies start paying these security companies to find bugs (which they don't) they will need to find other ways to make money or stop looking all together.