>I believe bounty programs are good, but they aren't a replacement for an actual security team.

Of course not, I don't mean to suggest that it is. I'm suggesting that this is marketing with potential for cheap labor more than a real commitment to security.