Yes, bug bounty programs usually dislike being told about inherent architectural issues. So far I've only come across one where all security-relevant feedback i

Yes, bug bounty programs usually dislike being told about inherent architectural issues. So far I've only come across one where all security-relevant feedback is welcome: Mozilla. Which is exactly why I'm not submitting this via the bug bounty program. This way it's far more likely to reach somebody who is responsible for the code.