It was enough for Orange. But think about demand elasticity. Perhaps there are 100 other Oranges for whom the bounty was not enough.

Clearly the bounty was not enough for the mystery attacker / researcher / hacker / whatever that Orange discovered exploiting the same hole.