If the bug bounty program doesn’t pay out much, there will be plenty of less reputable actors happy to pay more