I hesitate to defend Uber, but I think you're mixing the post-hoc reward of $100,000, with the propter hoc expected value of the guy's work. Such reward scheme

I hesitate to defend Uber, but I think you're mixing the post-hoc reward of $100,000, with the propter hoc expected value of the guy's work. Such reward schemes are set up as a sort of competition, or bet. You invest time not knowing if you will find anything worthy of a reward. If you expect to have a 10% chance of finding a vulnerability, the reward needs to be 10x the value of the work for it to a worthwhile use of your time.