5-6 years of living expenses.

Or 1 year SV senior developer pay

Fixed price anything (job, bounty) means very different things to different people.

Sure, but why would you advertise to those people? There are many very talented people in parts of the world that aren't the premier market for their skills that accept much lower salaries for their skills, or are employed in other industries altogether. I wouldn't be surprised if the number of people that match that criteria and have security research experience is much higher than the number of people in Silicon Valley and the other 5-10 leading tech markets that have the requisite security experience.

The world is a big place, and I think exploring security is fairly attractive to the weekend warrior programmer that might find other work hard to come by.

Even more in many countries

The government should let go the taxes on such bugs (not all).

Why should the government subsidize the cleanup of the messes created by these companies? That's like subsidizing BP for cleaning up their oil spill.

Not subsidizing, I was talking about the income tax on the researcher. Something which affects the whole population. It’s like someone finding a bug in a paracetamol and government rewarding him by not taxing the money he received from pharma companies. Not a great analogy but you get my point.

Giving a tax break for a payment is the same as subsidizing the entity giving that payment.