Side-note: isn't there a grey market that buys exploits (for sums of ~$100k depending on the exploit) and sells them to government agencies or larger corporations? I think I remember one company charged $500k / year to companies and government agencies who wanted access to their "exploit database". Seems like this is the best route to go with these kinds of exploits since it is completely legal.
How many times have people had to pay you not to commit felonies that are a) immoral, and b) could land you in jail?
I think most people don't need monetary encouragement not to turn black hat.
In the sense that "Oh yeah, I just casually stumbled on an enormous exploit of security software" the bounty is a good deal. In the sense that "Should I look for holes in this thing? Is it worth my time?" it's absolutely not unless the person is interested in it academically or for reputation.
In other words, I don't believe bug bounties incentivize people who would otherwise not already be looking, but it gives them a safe outlet and official validation that they can put on their resume/website/whatever.
Fixing this bug before an exploit is worth a LOT to the company. I think they have a moral obligation to pay more than 1k to fix it.
I also think it makes sense to award good-sized bounties, as at this point I would have no interest in their bounty program, were I hunting bounties.
This is more akin to finding the accounting records of a drug kingpin that could be used as evidence to bring them down. This could have destroyed Lastpass.
I think of it like drugs. $50k street value of cocaine is not going to do me a lot of good because 1) I'd have no idea where to sell it, 2) if I did know where, I wouldn't have the relationships built and would probably get ripped off/killed/what-have-you, and 3) selling drugs isn't something I'd like to do. So, if there were an option of turning in the drugs to the police for $500, I would take that instead.