The #xz backdoor was found without a bug bounty as motivation. #JustSayin
(if you conclude from that that I am not a big fan of bug bounty programs for Open Source projects as it is exclusive and many FOSS projects simply will never have the money for that or the ressources to team up with "Bug Bounty Service Providers" that offer this As a Service, you might be on to something ;)
