I don't know why you think that describes security bounty programs? They are about paying external people that find bugs and tell you so you can fix them with your people.