Bounties make sense for open source projects where the main reward is to contribute to the community.

For private corporations/closed code, it is a way to get a thousand engineers looking at their code and APIs and only pay a small amount to however is the first one to find something. Everybody else gets nothing even if they put a lot of time and effort.

Underpaid is an understatement.