> So seemingly the level of the bounty was reasonable enough that it worked as intended, and a much higher bounty would have been a waste of money for Tesla.

I think it's more likely that the person who reported the vulnerability would have done the right thing regardless of any bounty.