Another scenario is, having access to the code, being in a much better position to test and find vulnerabilities in the first place. Instead of disclosing them

Another scenario is, having access to the code, being in a much better position to test and find vulnerabilities in the first place. Instead of disclosing them internally which may just be expected and get you little extra, leak them to a trusted external partner for a share of the bounty.