The actual "bug" is that Facebook did not have sufficient controls in place to even detect this type of brute-force attack, much less make it impossible to attempt in the first place. Facebook seems (IN THIS INSTANCE) to have appreciated the white-hat nature of this and awarded the bug bounty, but it very well might not have. And certainly other organizations don't take nearly as friendly stances. Generally, I wouldn't bet on most organizations seeing brute-force attacks as in-scope for bug bounties - this is by no means legal advice though.