Ethical hackers, also known as white hackers, or information security analysts, do not steal data or cause damage. They discover the problem and report it to the site owner so that he can fix the error.
Many companies specifically hire people to conduct such testing and improve the security of their resource.
The work of an ethical hacker is paid, and a highly qualified specialist can earn a living from it. According to Glassdoor analytics, the average annual salary of an ethical hacker (in the USA) is $100 thousand.
But it is also possible that the company does not have a large budget and it will pay with its product or by publishing the analyst’s name on the site’s honor board in the section with information about developers. It’s not profitable, but it’s a good way for a novice IT specialist to form a portfolio of projects in order to get a job as a tester later.