You know a company isn't serious about security when their top security bounty is a t-shirt. Instagram has a better policy, for God's sake.
Plenty of companies that are serious about security don't do bounties. They're a real pain to administer apparently
I'd expect for a company that can MITM a good chunk of the Internet to incur that pain in exchange for all the money customer pay them.
I'd love to see some evidence that big bounties correspond to more exploits being found. In my experience, they tend to result in an increasing number amount of crap for your security team to sort through.
Instagram has been part of Facebook for over four years, so they are covered by the Facebook Bug Bounty: https://www.facebook.com/whitehat