I agree. I meant more in the sense that if the vulnerability is fairly obvious, multiple people will claim the bounty and if you try to simultaneously not pay all these people because their find was not unique, and also say that nobody has claimed the bounty, I can't imagine that going well. People tend to get mad when they don't get paid.
I did think this too. I would hope that I am small enough fish that I'm not worth them wasting that backdoor on, as I assume it will be patched once revealed.
At what point do I have to stop being paranoid so that I can get anything done?
Join me friend and welcome to the finer arts of procrastination, where our minds shall tirelessly conjure up vivid departures from reality in order to avoid doing something simple that needs to be done.