[joshuamorton]

On the other hand, if you boost these too much, you're now incentivizing your full time security researchers to have white box access to leave and make more money doing white hat black box vuln checking.

And from there it follows that maybe the market rate isn't really that high, zerodium pays, maybe 2x what Google does for similar vulnerabilities, which is more but not a ton more.