Yes, I have a friend who does this for a living. The trick is apparently to get a high enough rating that companies give you software pre-release, and you can vacuum up the low hanging fruit before everyone else.
He claims legacy car companies are bad at security and pay a lot.
