From what I've seen secondhand, a bug bounty programme can actually increase the overhead vs. an email address, because now someone has to log in and deal with each ticket instead of ignoring emails that don't seem interesting.

There are some significant advantages to having a bug bounty programme, but they still attract a lot of noise. I know of at least one software company that has an entire team just to triage the queue. Not fix anything, just validate whether a report ia reproducible or not and if so, route it to the responsible party.