"It's not a small sum, but if we had gone through the normal process of hiring an outside firm to do a security audit and vulnerability assessment, which is what we usually do, it would have cost us more than $1 million," ...

It seems like a a pretty small sum to me. They paid out amount between $100-15000 for the bounties with a total of $75000. Gauging that one of the bounties at $15K sucked up around 20% of the overall budget and there were 137 other reports - it's literally the equivalent of paying outsourced-ODesk rates for security testing in time/value.

What reason would anyone have for wanting to actively participate (not just poke-around like I'm sure quite a few employed professionals did) vs selling the exploits off on the dark web or just working in security for a company that pays a reasonable rate?