They were aware of the vulnerability for months. They chose not to adequately address it. A bug bounty wouldn't solve that problem.