They're brilliant at finding this stuff, sure, but incompetent when it comes to business acumen and valuing their work. Usually. Those that have some semblance of the latter, have received in the six figures from singular bounties. I haven't yet read this, and to be fair, most bug reports identify low severity issues which obviously don't deserve a six figure payout.