The press release specifies that the $1000000 quoted figures are minimum payments for the given category of bug, so the actual amount paid could be anywhere upwards from that.