The idea of bounties is interesting, but from my experience they can actually slow the process of reporting vulnerabilities, because another team looks at the report before the original vendor sees it.  It might not even be forwarded to the company as the initial third-party triage team can decide it’s not important enough. These cases might be dangerous and can leave vulnerabilities unpatched.