I believe most of them donate the bug bounty money to some charity.
That's not really double dipping, that's more of a bonus.
But it causes an enormous conflict of interest...
Hey Bob can you make a bug, I'll report it, and we'll split the pot?
Confused, which company would Bob be working for here? How would he make a bug?
Also is there not always a conflict of interest with bug bounties anyway, as a friend of an employee could always 'find a bug' somewhere. I'm not sure I see the how being Project Zero or a normal user makes a difference.
That supposed conflict exists with any bounty program no matter who the bounty hunter works for.
While it's important to design bug bounties carefully: