[pcthrowaway]

There are loads of bounty payouts in the hundreds of thousands. Probably 1000 payouts per year at that size. Most protocols would rather pay out $1 million than lose $100M to an exploit.