It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable

It's definitely possible. A few of the researchers I've seen on BugCrowd that we help foster good relationships with, e.g. paying out quickly and with sizeable bounties, easily make 5 figures USD from us in 12 months. And I'd hope we are only one of their many clients. We might be an outsider though, my company does very well to address the bugs that are brought to us fairly. We understand the need to encourage the top 100 researchers on the platform an incentive to look over our stack. That's where the value is. We do get a lot of spammy notifications too which sucks but it's part and parcel with the issue mentioned here. We leverage BugCrowd to help filter the chaff from the precious metals. :)