The difference I think most people are missing is that Hackerone will not pay you if you don't find a bug. So they do not value your time, they value the results.

Leads to the conclusion that they should pay for the results and not for the time it took to find it. Also, there might have been weeks of failed attempts before finding this.