The bounty payouts must be public in order to serve as an incentive.

Just imagine what the press would be when somebody breaks that NDA

>should be paid multiple years of a high end vuln researcher salary per single discovery

What? Why would anyone work at a company paying them that much less than they pay the contractors?