They seem to be focused on commercial software only, and the slides of a ZDI's CEO talk (can't find them now) mention how they rejected various submissions because the vendor was not a Fortune 100 company. The talk was from some years ago. As far as you know, do they accept submission for non-commercial software too, provided that it is a widely deployed, high value (eg. firewall, IDS) piece of software and the vulnerability is critical (eg. Unauthenticated RCE, reliably exploitable)? Is the "we don't accept non-Fortune 100 companies" still a thing?