I don't understand how this isn't already reflected in bug bounty pricing tiers? Like, if I access your contacts, I get $x, but if I can access all your photos, I get $xx. As a user, I couldn't care less for how my data got accessed, whether it's a logic bug or memory corruption…
Is your point that all bugs soak up time to fix? If so pay the bounty and add it to the backlog. Or is it too much time to verify? That seems to be something you can kick back to the reporter.
Apologetics for a bug bounty program dragging their feet on a payout because "it's not a mem corruption bug" alone is unconvincing.
If Apple wants to nudge people towards submitting more serious bugs, they can pay more so people are incentivized to work towards those rather than mucking around in gamed. But, they don't really get to say "we didn't really have time to get around to this Contacts bug, sorry": people expect them to have it fixed. That's the whole reason Apple offers a bounty at all: so that researchers tell them about it early so they can fix it.
It would be interesting to understand at what point this becomes a GDPR issue, and if the GDPR legislation can be used to pressure companies in expediting this process.
* There are valid reasons that bugs can take longer to fix than you'd expect; the most notable of them is when the bug you found is actually systemic, or has a deep root cause, and the real fix for the vulnerability is more complicated than the surface bug. Without a hard timeline, some shops will work to get the root cause fixed on some bugs even at the cost of an increased timeline, because the patch for the surface bug reveals the pattern and amplifies risk to customers.
* As a reporter, you can take some measure of control over the process back by providing a fixed timeline (like the P0 90 days). There's no negotiation needed; you give the vendor time to fix and they either do or don't, but either way you're going public. That is a valid way to go about things, but may cost you the bounty.
* These things are bug-dependent, and the process that runs for a zero-interaction RCE won't be the same as the process that runs for a bug that requires a malicious app store app and only gives access to the contact database.
* Message boards tend to expect that big vendors can just shell out for the bounty as a show of good faith. It's easy to see why they believe that. It makes sense. But it also creates broken incentives. The limiting reagent on bugs isn't bounty dollars (these are indeed barely even rounding errors to major vendors), but rather programmer time. If you pay out for weak, stuck-in-process bugs, you create incentives that redirect programmer time to those weak bugs and away from more significant bugs; as angry as you can reasonably be about a malicious app being able to snarf your contacts, if you're rational, you're a lot more concerned about memory corruption flaws, which is what you really want people spending their time on.