It is just supply and demand. The systems are so riddled with security defects that the offered prices are enough to incentivize more reported defects than they

It is just supply and demand. The systems are so riddled with security defects that the offered prices are enough to incentivize more reported defects than they can fix (though to be fair, the Pwn2Own bounties are on the low side due to payment in “fame”). If they offered 20x the price there would likely be so many reported defects that they would go out of business. You can not “patch and fix” your way to a materially higher level of security “quality” or buy your way to zero defects. Offering prices significantly higher than your security “quality” just gets you a endless stream of reports for real defects. To put it another way, a bug bounty program is not a mechanism for achieving higher quality, it is a mechanism for public security auditing. It is set at a level where it should almost never trip and should be viewed, publicly, as a initial estimate of security “quality”. A company offering a bounty of X should be viewed as saying: “We are confident that our security is no better than X worth of effort”. That should tell you everything you need to know about the “quality” of these systems.