If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from researching security vulnerabilities?
In the 'white' sense, the most well known companies that pay researchers to buy vulnerabilities or exploits are:
Certain companies like Mozilla and Google have established bug bounty programs - they buy vulnerabilities of their software themselves.
Charlie Miller (famous exploit developer) has written a small paper on the topic - it's an interesting read: The Legitimate Vulnerability Market: The Secretive World of 0-Day Exploit Sales (2007)
I'd say it has a lot do to with the order of operations:
Unless there's bug finding program set up already, attempting to find vulnerabilities and hacking look pretty much the same without a pre-existing contract.
I know a few independent/small company consultants who manage to make a living working as a tiger team for companies. I'd say the hardest part is getting the reputation, so you can make a case to the company that you should be the person they pay for this work.
The bug bounty programs and competitions like pwn2own come to mind.
Would not be an exhaustive list but large companies that offer bug bounties:
Microsoft is a notable exception.
You could also get a research grant from Universities and the government.