Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will.

It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.