Also is there not always a conflict of interest with bug bounties anyway, as a friend of an employee could always 'find a bug' somewhere. I'm not sure I see the how being Project Zero or a normal user makes a difference.