My experience from being involved in a couple of them (though obviously not quite on the scale of Microsoft) is that people underestimate both the difficulty of

My experience from being involved in a couple of them (though obviously not quite on the scale of Microsoft) is that people underestimate both the difficulty of running bug bounties and the average quality of submissions to them. When I worked at Mozilla on the MDN team, for example, there was a lot of inevitable spamming of "security" bugs which basically boiled down to "MDN is a publicly-editable wiki and hosts code samples" (MDN also goes to some trouble to do that safely). The current bug bounty exclusions are still pretty broad as far as I can tell, and thankfully will automatically throw out a bunch of the worst of the spam. Same thing happens still with Django. I've considered writing up something with similar exclusions to Mozilla's policy just because it would save time dealing with meaningless reports (though Django would get a few categories the Mozilla policy doesn't, like "it's not a vulnerability if the only person you can CSRF is yourself").