If I was WhatsApp I would offer a larger bounty. If they get the 0 day they could fix it before it gets into the wrong hands. I would think 500k is a drop in a bucket for them, and give them good press that they are actively keeping up with privacy/security of their users