That's pretty much how every bounty works... obviously it's going to be at their discretion for an incomplete attempt.
it's unusual to have to sign the NDA for a rejected bounty
it's unusual to have to sign the NDA for a rejected bounty