There are some rumours that other big players will start a bug bounty program soon. So I won't be surprised if Microsoft will pay for vulnerabilities too.