who will happily come in and sort out your security issues later

I really doubt anybody will be happy about it, even after considering the size of the fees. And also, you have a very high estimation of the capacity of those people to notice they have to call you, I really doubt it's deserved.

Deserved. These companies need to find it out the hard way.

So I can do programming and find and fix bugs.
How do I go on to advertise myself to them as a security researcher and get that hefty hourly fees?

Problem is, I am not very good at fooling people marketing.

Yeah, because at least a decent 3rd party might hand you documentation and have the sense to build something consistent or maintainable. AI has a limited context scope and frequently suffers a type of short term memory loss that results in repeated work or variations in work that confuse the end result.

Yeah, unlike an outsourcing outfit an AI company won't take the fall when given shit requirement and shit pay they deliver shit work.