I won't say such a solution is without merit, by any means, but it lowers the barrier significantly to mass requests of bug bounties of increasingly trivial nat

I won't say such a solution is without merit, by any means, but it lowers the barrier significantly to mass requests of bug bounties of increasingly trivial nature. Since the entity paying out has less knowledge of the product being reported on, it's arguably difficult for them to know if a bounty is justifiable, and since the developer isn't on the hook for the money, they have little incentive not to agree to pay out. The combination to me feels like a recipe for a lot of payouts for dubious reports. And in at least one case, a request was made to mark a report as valid even though it wasn't really a security flaw or something that was going to be "fixed". It's good to hear someone has had a positive experience though!