Do you pay a software engineer for their time based on your revenue or his skill?
Surely a bug on Chrome is worth more than a bug on Firefox.
But more to your point: the bounty is more similar to an auction. Once you sell the bug to the software producer the black market has no more use of it, assuming it gets fixed.
Supply is constrained, so competition is on the demand side.
On the drug example demand is constrained, if you're the only buyer. So competition happens on the supply side.
That is why you see equivalent skill levels being paid differently in big tech compared to other places.
And why you see millions in salaries at some big techs Ai hiring.
It's really no secret that higher revenue means higher potential pay/more devs...