I agree with you if we're talking about someone who is just getting started in programming and debugging. It's not a good starting point if you want to understa

I agree with you if we're talking about someone who is just getting started in programming and debugging. It's not a good starting point if you want to understand why these bugs exist or how to exploit them. But if we're talking about someone who is already a competent programmer, perhaps looking to learn a new tool, there's just no point (except perhaps learning) in trying to find bugs manually in production software by reading code or by trying to write test inputs that invoke unwanted behavior. After all, most code works fine at least 99% of the time, finding the 1% manually is a lot of effort. Tools like afl-fuzz or static analysis tools are so much faster (when you throw enough CPU time at them) in finding unwanted behavior that there aren't many reasons not to use them. For learning and getting started with exploits, I like your idea of using some kind of "weakened" VM, but that's a whole different deal than finding and fixing bugs (not even talking about exploiting) in production code (which is where the bounties are).