Assigning dollar values to this kind of work gets messy, fast.

Imagine if someone iterated on the exploit presented in the article so that it became a persistent "softmod" - who gets the funds?

Bounties also discourage open collaboration. For example, if person A has the first half an exploit chain and person B has the second, they're each incentivised to keep the information to themselves and try to get a full chain on their own to claim the bounty. Of course, this assumes they're financially motivated - but if they're not there's no point in the bounty in the first place.