DNS enumeration (brute force) with a good wordlist, zone transfer, or leaking the name through a certificate served when accessing your host via IP address are all possibilities.
The name "userfileupload" is far from not-obvious, so that would be my guess.
The important distinction, and where the comparison might fall short as the job-advertisement purpose of this post, is motivation. Speedrunners enjoy games because games are fun. Speedrunners get to actually use these vulnerabilities in a way that is meaningful in their lives, whereas vulnerability researchers typically don't.
This is an observation about cyber security in general, but in my experience, bug hunting and reverse engineering require a lot of tenacity at a level that writing software and other areas of IT do not. I think tenacity is a difficult thing to summon if your only tangible motivation is a salary, the target software is intrinsically boring, and you know that you'll be rewarded whether or not you find the bugs.
Forgive me if, in the current political climate, I feel a very large amount of skepticism at an opening paragraph where an anonymous woman of color expresses that she's always had it easy in the tech industry because of "DEI".