I have paid anonymous security researchers in past bug bounty programs, and would do it again. Way better than paying anonymous ransoms later.

I’ve done the same, but they eventually need to provide a bank account, which generally is at their name