The Trail of Bits piece kinda ignores the amount of time invested however: https://www.techrepublic.com/article/bug-bounty-programs-eve...