Don't know the range of their bounty program but seems like this exploit is circumstantial on finding a subdomain which was left hanging. Once they registered that subdomain on their own account, this exploit seizes to be effective by third parties so reproducibility is minimal (subdomain can be registered once). Unless you plan to sell the exploit once to one client or just re-use it once at a time by selling access to it (too much trouble, centralized risk).