Bug bounties can pay well, but companies often use multiple bugs to pay out large awards, and some vendors will even pay double for specific products. Experts question whether anyone would actually pay $100,000 for a vulnerability on a darknet marketplace.