Directly from the first three sentences of your link: > Paying people rewards for finding security flaws is not the same as hiring your own analysts and tester

Directly from the first three sentences of your link: > Paying people rewards for finding security flaws is not the same as hiring your own analysts and testers. It’s a reasonable addition to a software security program, but no substitute. Sounds like a reasonable addition to me!