Please do not take it the wrong way, but investing your time and resources into a bounty program is nothing different than investing financially in a project / ICO. As many lost "something" to scams or shitty projects within a bounty program, a lot of other lost money too. So it's all about evaluating a project and a team no matter how you invest in a possible "future reward".
I don't want to go off-topic here, but I am the only one who laughs every time I see someone talking about "investing" in an ICO? Almost all ICOs have no product, no company, no finances, no accounts and no vision. If this is your definition of investing, you might as well "invest" in a 5-year-old's lemonade stand. You aren't investing, you are gambling.