They claim to, but they drag their feet, demand terms most researchers find so unacceptable as to be a bit immoral (the point of "responsible disclosure" isn't, in fact, to hold secrets from the public arbitrarily long), and often end up paying only a fraction of what was expected, if anything.

https://pxlnv.com/linklog/apple-bug-bounty-troubles/

https://www.marketplace.org/shows/marketplace-tech/looking-f...

https://mjtsai.com/blog/2021/07/13/more-trouble-with-the-app...