Totally agree with you. Even knowing (most of them) are insured, there's no better way to feel safe than having permission to search for vulnerabilities, report them, and have them fixed. Otherwise, I wouldn't want them keeping my money.