The article mentions that the bounty private key(s) would be embedded within the device, so I don't think a submission would be necessary.
Now that's just double stupid. Just dump the flash and done.
The rampant goalpost-moving in their response suggests that they'll never actually pay out. I mean, their response to the author pointing out that it can be infected by drive-by malware sites is "don't visit those sites".