If someone did actually find a vulnerability, I would assume they are pretty good at what they do, but wouldn't they just wait for adoption and let this bounty inflate higher before draining it?