The third party doesn't know about the vulnerability. Company C posts bug bounty B in contract. Researcher X discovers vulnerability. Validator Y confirms the vulnerability and X gets paid (1-f)B where f is validator fee.
OK, so why doesn't Y hold the money as well, given that they're in the position of deciding whether or not X gets it?