This scenario is more of a lootbox/gambling — a chance to win a big prize, but no gaurantee. A proper bug bounty system would be a consistent outcome, and far more fair.