It's still ridiculously good by bug bounty standards.

Zero-day buyers are going to have a hard time topping that.

Bounty is $2 million, grant is $10 million.

You could easily get more for selling a zero-day likely this than reporting it to Apple. If you combined the risk this is being turned on is reported back to Apple or remotely detectable, combined with a zero day, it would be a goldmine; cover this and other issues in my comments on the topic:

https://news.ycombinator.com/item?id=32006436

I like money but something tells me targets of such attacks might end up dead, so it’s more about ethical considerations rather than who pays better. The bounty won’t sway everyone but $2m would sway more people than $1m which would be more than $10k

where are the cash reserves documented?

see: https://investor.apple.com/investor-relations/default.aspx

Specifically the 2022 Q2 financial statement(it's a PDF). under "Cash and Cash equivalents" on the 2nd page, you will see: 28,098

That's in millions of dollars(see top of that page for source), so they have 28 Billion USD just laying around.

10M/28098M = 0.0004 so it's 0.04% of their cash.

Thank you