They're only shooting themselves in the foot with this approach. The bounty means they admit there's a good chance there are bugs, and the lowball price means it'd be far more profitable to exploit it rather than turn it in.
Who makes these decisions, and what are they thinking?