It can be good money, but it can also be a big time sink; really just depends on the site. CCBill was super easy for me on the whole, but I've struggled with others: I only found 3 or 4 bugs in PayPal, never found anything in Facebook, etc.
I submitted a couple bugs a while back, and they asked for some clarification on one of them which I didn't ever take care of (just haven't had the time or motivation). Given that, I really don't have any opinion on their bounty program either way thus far; should I ever put some real effort into it, I'll probably write about my experience.
Only when the bugs are easy to find.
Edit: And you're as exceptional as Daeken. I'm a builder, not a breaker. I'm awful at security beyond knowing better than to do anything but a random token + short lifetime.