> If it was easy to cheat, someone would claim the public bug bounty by giving themselves all the coins.

But giving yourself all the coins means demonstrates that the system doesn't work conclusively, and guarantees that no one will accept the coins for goods and services, so while giving yourself "all the coins" destroys a lot of value, it doesn't actually capture any value. So, if you wanted to profit from an exploit you developed, you would not do that (if you wanted to discredit bitcoin and had developed the exploit, you would do that.)

Right, they'd trickle them in to keep it secret. But that doesn't change the bug-bounty nature.

It changes the (paraphrased) "we can tell its secure because no one has visibly compromised for profit it the way they would if they could" nature you suggested uphtread, because, for profit, you would avoid visibly compromising it.