It sounds like they were never given written confirmation for the bonuses. How likely are you to face penalties if you put a "time bomb" in a codebase like this? Something with plausible deniability like let's say like an authentication script that you have to run every 30 days or the program stops working for "security reasons". Also you're the only one who knows where the script is and how to run it.