Don't confuse the act of earning money for spending a certain time acquiring a proportionally certain quantity of money. Money is not time and time is not money. Money, in this case, represents coercive power held by the security researcher and bug bounties are a means of buying that coercive power from those researchers who would otherwise find another mechanism of extracting value from that knowledge.
Security research viewed exclusively as coercion is passe.
It's an absurd take. Plenty of folks who work in tech can make money doing hackery dark magic, but guess what? It's not their day job that keeps them from doing so.
This. I am quite weary of the default dim view of humanity. We're not anywhere as bad as that on average.
The company has something it wants: security audits. It pays people who do audits and find things.