That assumes that the bounty should approximate the expected payout from some lawsuit against twitter plus loss of future cash flow due to the vulnerability. I

That assumes that the bounty should approximate the expected payout from some lawsuit against twitter plus loss of future cash flow due to the vulnerability. If that value is still small, then there is no incentive to raise the price of the bounty.