I don't follow your argument. We are discussing whether the bounty is high enough to provide a good incentive for researchers to pick up and report issues like

I don't follow your argument. We are discussing whether the bounty is high enough to provide a good incentive for researchers to pick up and report issues like this timeously. It's impossible to know if anybody else has been abusing this for some time or not, and it's a valid concern for people here to argue the bounty is low enough that this kind of valuable exploit may have ended up on an exploit marketplace in the interim.