Once you reach a certain bar, people do the right thing.
$40k isn't enough to cover the cost of research+reporting at livable salaries, let along overhead, fake starts, etc.
1) Microsoft could afford $10M
2) I think people would be honest well short of $10M
3) The cost to customers, if this went public, would be far more than $10M.
You want people to be able to make an honest living on security research, or otherwise, the only people looking for vulnerabilities, aside from the independently wealthy hobbyists, will be crooks.
The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
Knowledge required to find stuff like that is very scarse. And you have to know where to look for.
Chances to find something really big are so small that its not worth it to look for them finnancially.
Thats why ppl don’t do that often. They do it if they have long cooperation history with given company because they are treated as an employee.
TL;DR is that you don’t want to encourage ppl to start looking. All software has bugs, so its only a matter of time until someone finds something.
The reality is that if an organization is using a managed database and doesn't have service-provider vulnerabilities as part of their threat model, they are naive and arguably negligent.