I think it's designed to be enough to convince would-be hackers to reveal the bug, but not enough to incentivise large amounts of people to sit around all day every day trying to break Facebook for bounties.