Having given up on the original argument ("Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.") you've now transitioned to a new one: that vulnerabilities can be used by the hackers who find them to plan heists. And that is true. It doesn't set any kind of market-clearing price, and selects for actors who are comfortable ending up in prison, but it is indeed a statement that aligns with reality.

My original comment explicitly said “selling or exploiting them for profits.” You are just ignoring the second half for some reason.

I think you need to breathe a bit and then re-read my comment. I’m not coming at you, I’m saying that what an exploit sells for and what it could cost a company if exploited are entirely different things. That’s where you’re hung up.

Companies have an obvious financial incentive to encourage discovery and disclosure before exploitation.