Are you seriously suggesting that it is OK to open a bug bounty for e.g. a webpage that you know has XSS flaws, and then refuse to pay out when someone exposes them because "yeah, we sort of knew that there were XSS, and we're hoping to move past our legacy framework. Closed informative"?

Don't open a bug bounty if you have unresolved known issues unless you are prepared to pay out, thats bogus.