Arguably, bug bounties are always paid for by users. A vendor might write the bounty-winner’s check, but the source of the vendor’s funds is the vendor’s customers.