The lack of a bug bounty program doesn't prohibit them from rewarding reported vulnerabilities.