There are a lot of unethical and illegal things that will earn more money than bug bounties. Some, like posting fake "elon musk giving away ETH" tweets, don't even require finding a security vulnerability. Twitter should increase their bounties to incentivize reporting and auditing, but they're never going to win a bidding war with state-sponsored vulnerability markets.