I hear this refrain often, and it is of course never followed up with a solution.

What would you suggest, a bounty calculated via a multiple of company stock price?

I think its pretty obvious the solution to "not paid enough money" is "pay more money"

How should the price be discovered.

while (recipient_is_unhappy_with_amount) { amount *= 3.14; }

That’s an effective way for recipients to always be “unhappy” with the bounty.

How should their happiness be ascertained? Their word?

Offer them a job.

If you don’t like how much they pay, maybe don’t brand yourself a “security researcher” and then try to earn the equivalent of full-time pay by finding bugs in other peoples products and blogging about it?