It doesn't say they paid out yet, just that they 'awarded' the bounty, which could just be GitHub telling HackerOne they intend to pay without actually having moved any money yet.
And this was definitely approved before they went out and told people what they would pay for different bugs.