But the transparency you're asking for is difficult to actually provide. Meanwhile, for a vendor at Google's scale, there is essentially zero upside to screwing over bounty hunters. At any realistic valuation for a vulnerability, these are rounding error sums to the business. In fact, the exact opposite incentive exists: these bounty programs are deemed to be performing well when they pay out more money, not less. The people managing these bounties aren't paying with their own money. They'd rather make you happy and encourage you to submit more stuff.
The two phenomena you describe here are real and common. But it's just simply the case that vendors are generally working through backlogs of issues, triaged by severity. If you're told your finding is a dupe of a private issue, it is overwhelmingly likely that it is. If you pay for every independent discovery of an issue, people game that; worse than the dead weight loss of the bogus bounties, you set up crazy incentives on your dev team to fix marginal issues because they're being gamed, rather than triaging according to real severity.
And, bounty hunters do turn up real bugs that aren't real security issues, but are still bugs. If those bugs are easy to fix, they're going to get fixed! You have the same weird gaming and precedent issues if you start paying out non-exploitable bugfix findings; you encourage people to find and report non-exploitable bugs, and you screw up the team incentives on what to fix.
I don't expect people to like any of this logic, because it boils down to "you should just trust the Google VRP people". But: you should. This isn't worth the cortisol. If it's driving you up a wall, maybe don't participate? There are other ways to market security bug finding skills. :)
If you've never worked triage on a bounty before, my guess is that you can't really imagine how terrible the median interaction is. Maybe the next evolution of these programs will be long-term contract relationships with trusted, successful vuln hunters that address some of these concerns by separating out the people who are good at this stuff from the median submitter (the median submitter invests 2 weeks trying to litigate whether copying a cookie out of the Chrome inspector and pasting it into curl constitutes an account takeover vulnerability).