I think that this is becoming more and more common lately, so what can we do to ensure that responsible people can be punished?
I think the easiest thing to do is to contact the developers before investing or before you decide to participate in the bounty of this project.
the best way to prevent ICO project be responsible to bounty participant is made a written contrant for ICO dev and bounty manager regarding bounty participant and put it on bounty thread and also bounty manager should know ICO dev contact person either their real address or passport, so that they will think twice for running from their responsibility to bounty participant.