There must be other corporate bounty programs they could DDOS with fake reports - doing it to curl surely won't yield much profit.
the thing is, these people aren't necessarily wrong - they're just 1) clueless 2) early. the folks with proper know-how and perhaps tuned models are probably selling zero days found this way as we speak.