You're right. I shouldn't have said "more profitable"- obviously you're going to get more money immediately by exploiting a bug that gives you direct access to everyone's bank account. What I should have said was "more attractive".

If I have to choose between 5 year's wages with a 90% chance of going to jail for a very long time vs. a month's wages as a bounty and a 0% chance of going to jail, I'm going to pick the bounty every time. I think a lot of people would agree with me.

As discussed further down in this thread, raising the value of the payout or lowering the possibility of being caught makes the other side more attractive.

(of course, I would choose to disclose every time, because I'm just a good person.)