Don't confuse the act of earning money for spending a certain time acquiring a proportionally certain quantity of money. Money is not time and time is not money. Money, in this case, represents coercive power held by the security researcher and bug bounties are a means of buying that coercive power from those researchers who would otherwise find another mechanism of extracting value from that knowledge.