You're wrong. Because almost all projects indicate such an item. The team can change the rules at any time. What does this mean? That the law of law does not help here.
I'm sorry but KYC is such a sensitive item as it involves doling out personalized documents to unknown online entities whose real intentions with those documents can not known. While I agree that the bounty manager reserves the right to change the rules at any time, I'm still of the opinion that bounties should state it ab initio as a requirement for participation and claim of earnings.