This leaves out the possibility that a company puts out a bug bounty without ever paying any reporters. A company could simply dismiss most reports as duplicat

This leaves out the possibility that a company puts out a bug bounty without ever paying any reporters. A company could simply dismiss most reports as duplicates, maybe even with a fake hall of fame, and get away with this for a long time.