The lions share of bug bounty reporters are from overseas.

I can't even remember a single submission from an American in the bounty I'm involved with.

So in conclusion: if you limit yourself to just that audience, and tempt them with only miles, most americans who are competent enough to obtain bug bounty rewards are making enough money that miles is kind of a dubious incentive. So sure- you save money, but you get fewer submissions, and you get less return on investment than a bounty that pays out.

It's far cheaper, especially since miles are so hard to redeem. United has so few seats per plane for miles users that they are nearly worthless. I have hundreds of thousands of miles on United and can rarely ever use them for a flight I want unless I am willing to make 4 or 5 hops.