The economics of bug bounties from a “bug hunters” perspective are quite interesting! I’m going to give the short version.
There are public (such as the one being discussed here) and private programs.
To gain access to private programs you have to be invited to participate - you get an invite usually based on reputation for providing good reports on public programs.
Platforms like H1 and BugCrowd act as intermediaries for this, with reputation scores, etc.
It should also be noted here that if you rediscover a bug someone else reported, you don’t usually get paid.
With public BBP/VRP, you are competing against everyone in the space against a relatively limited subset of targets. The way to “win” is to either “go deep” against high payout targets, expending a lot of effort in the hopes of avoiding a duplicate finding, or to invest heavily in automation, or some combination of the above.
With private programs you are competing against many less people and have a higher probability of payout for time/effort expended.
The guys who tend to make a shitload of money off BBP/VRP either are focused solely on a handful of high payout targets, or have invested heavily in automation to grind public programs, gain invites to private ones, and repeat.
A lot of the better offerings in the “continuous vuln scanning” or “attack surface monitoring” market are from people who have been “full time” bounty hunters for a while, built out significant automation platforms, and pivoted to offering it as SaaS products to enterprise for detection of issues.
There’s a lot more to it, but it’s probably worth a blog post at some point tbh.
In my own experience, as someone who has participated in bug bounties and vuln disclosure programmes in my free time for about a decade now, I usually land a couple of nice payouts per year and a lot of issues reported without payment.