It can be good money, but it can also be a big time sink; really just depends on the site. CCBill was super easy for me on the whole, but I've struggled with others: I only found 3 or 4 bugs in PayPal, never found anything in Facebook, etc.
I submitted a couple bugs a while back, and they asked for some clarification on one of them which I didn't ever take care of (just haven't had the time or motivation). Given that, I really don't have any opinion on their bounty program either way thus far; should I ever put some real effort into it, I'll probably write about my experience.