If requesting payment from an affected party directly for the disclosure of vulnerabilities is considered extortion, how can independent security researchers earn a living or side income from researching security vulnerabilities?
In the 'white' sense, the most well known companies that pay researchers to buy vulnerabilities or exploits are:
Certain companies like Mozilla and Google have established bug bounty programs - they buy vulnerabilities of their software themselves.
Charlie Miller (famous exploit developer) has written a small paper on the topic - it's an interesting read: The Legitimate Vulnerability Market: The Secretive World of 0-Day Exploit Sales (2007)
The bug bounty programs and competitions like pwn2own come to mind.
Would not be an exhaustive list but large companies that offer bug bounties:
Microsoft is a notable exception.
You could also get a research grant from Universities and the government.
I'd say it has a lot do to with the order of operations:
Unless there's bug finding program set up already, attempting to find vulnerabilities and hacking look pretty much the same without a pre-existing contract.
I know a few independent/small company consultants who manage to make a living working as a tiger team for companies. I'd say the hardest part is getting the reputation, so you can make a case to the company that you should be the person they pay for this work.