It really should be, as social engineering is still, and probably always will be, the most vulnerable attack vector.
White hats will become millionaires overnight
Given how low quality most reports are for bug bounties, putting social engineering in scope publically would be dreadful for any employees. basically just authorized mass spam. social engineering in a private pentest though, sure.
I don’t think you read the whole article. One of them earned quite a few bug bounties.