Do you bounty hunters get paid in ETH or do you receive the ICO token (which is erc20 in most cases)?
It depends on the bounty. Some bounties pay in BTC, some in ETH, some in their token. You can easily see this on the bounty thread; and if they didn't specify, you could easily post a reply on their thread and ask them.
Suppose you receive it in their own token, I assume you cannot do anything with them until they get listed on an exchange, correct?
Yes.