I would hope there is sufficient discouragement for that sort of behavior - that's definitely breaking at least two federal laws. Maybe I'm naive, but I would

I would hope there is sufficient discouragement for that sort of behavior - that's definitely breaking at least two federal laws. Maybe I'm naive, but I would think that any programmer skilled and privileged enough to be able to insert a vulnerability into a mainline product, get it past code review, and make it look like an innocent mistake during the inevitable root-cause analysis would not only know better, but would also value their career enough that whatever payout they got from the bounty wouldn't be worth jeopardizing all they've worked for. And anyway, how's that conversation supposed to play out? "Sorry about that bug boss, yeah could've happened to anyone. Anyway, about my retirement in two weeks..."