Yup. Then you get things like the Twitter hack a few months ago where a bunch of celebrities were tweeting a crypto scam. I'd bet that wouldn't have happened if bug bounties were paid and reliable enough.