A "private" beta enforced solely by a clientside check, notably.
Sure, but the client-side check completely limits the exposure Cloudflare have because big enterprise corporates don't get themselves into a private beta by playing with client-side checks. Only a few companies were using this feature at the time.
A well-run bug bounty should encourage early reporting of issues. Should he have waited until public release so the impact was bigger?
It's a moot point because this hasn't happened. Cloudflare didn't lower the payout because it was in beta.