Because a bug bounty does not guarantee that people actually look into your code. Of course some white hats while invest time upfront, but there is no guarantee

Because a bug bounty does not guarantee that people actually look into your code. Of course some white hats while invest time upfront, but there is no guarantee and absence of payed bounties is not evidence of absence of bugs. Also, a bug bounty usually limits the scope a lot more than a typical pentest does, i.e. no testing of infrastructure security, internal networks etc.. Lastly, if your bug bounty is high enough to make highly skilled people spent time to find your bugs its probably cheaper to just higher some security folks yourself and prevent excessive payouts (by preventing bugs). Of course all of this does not stop some C-levels from using a bug bounty as replacement, but the issue is not as clear cut and especially the last point should even make sense to non-technical people.