Granted Heartbleed was only exploitable for a few years, but Shellshock was available since '89

And I'm pretty sure bug bounties would apply to shellshock and heartbleed as long as you can find a company with a bounty program that also used openssl or could be exploited via bash.