Restricting the number of bounty participants is a decision best left to the funding project teams, not to this forum or any outside "regulator."  Every project is different - if a project team wants a huge bounty population, they will create an easy airdrop campaign.  If they want a small, tough bounty, they will offer just a handful of people tokens for doing some extraordinary work (translation, moderation, software debugging, publicity, whatever).  Why even think about setting rules to govern these kind of programs?