Please do not take it the wrong way, but investing your time and resources into a bounty program is nothing different than investing financially in a project / ICO. As many lost "something" to scams or shitty projects within a bounty program, a lot of other lost money too. So it's all about evaluating a project and a team no matter how you invest in a possible "future reward".
I don't want to go off-topic here, but I am the only one who laughs every time I see someone talking about "investing" in an ICO? Almost all ICOs have no product, no company, no finances, no accounts and no vision. If this is your definition of investing, you might as well "invest" in a 5-year-old's lemonade stand. You aren't investing, you are gambling.
Of course there was a hype and everyone tried to quickly make some easy money, and right, a lot of ICOs have no visions, products and so on. But this is due to the fact that everyone wanted to launch an ico and constructed an idea in the framework. Now is the time for startups with real ideas and products, where a token offering is the most suitable solution compared to classic venture capital. And yes, this is gambling, but funding startups is always gambling.