It doesn't surprise me. This phenomenon has become an epidemic lately. The employees are usually the vulnerability that these guys look for and is why they need special training when it d comes to cyber attacks.
> The employees are usually the vulnerability
which makes it especially strange for the CEO to call it a "bug bounty". I'm not quite sure how a bug in humans can be resolved by a contract IT firm.