Why would anyone pay for a denial of service attack when DOS bugs are so ubiquitous that you can often not even get paid for finding one? Folks seem to only want remote code execution... so damn nebby.

(That type of bug bounty policy is how you get folks hording them for a cold winter rather than disclosing them to vendors.)