It is absolutely worthy of a reward, and it should be worth a few months of your time. This is a nasty security issue, and you showed a ton of restraint not losing patience with Apple.

Honestly, it's bullshit that you don't already know whether or not you're going to get a bounty.