Check their gitlab for bounties. They have a lot of money in reserves to be spent on that. There are a few open bounties for hundreds of thousands of dollars. I've also worked on a bounty for them once and can confirm they have plenty more money in their budget. So I believe that they don't pocket donations, or at least not a very large portion of them.