Yes, bug bounty programs usually dislike being told about inherent architectural issues. So far I've only come across one where all security-relevant feedback is welcome: Mozilla. Which is exactly why I'm not submitting this via the bug bounty program. This way it's far more likely to reach somebody who is responsible for the code.

Also forgot step 1a, which is get your subtitle right. The title at least is mildly interesting.