Hacker News Reader

I suspect the bug bounties are much more about deterring the sale of exploits to bad actors than about recruiting employees.

It's both. You could do the former by throwing huge sums of money at the problem.

What's your definition of huge?