most RCE bugs can be compounded into major data dumps. That doesn't make each individual RCE a million dollar bug.
Think about this guy being a Russian hacker and selling the ability to access restricted accounts, pose as Instagram administrator and I assume access user's data freely
Every RCE that could have been sold on the black market for a million dollars is worth almost the same reward (modulo the advantage of being legal).