The part of the work you don't see is the hours, days and months spent, usually unpaid, spent auditing code to find the bugs.
It is like the anecdote of Tesla and Ford and knowing where to put the X[0], you aren't paying for time or manual labour - bug value is derived from how much damage it can cause, what its worth to Facebook to not be exploited and what the exploit is worth to the bad guys on the black market.