If the payout were too small, nobody would bother researching vulnerabilities and claiming payment while following the rules. The fact that people are doing it

If the payout were too small, nobody would bother researching vulnerabilities and claiming payment while following the rules. The fact that people are doing it suggests the market is working (and perhaps the payment is even high considering how much participation is going on).