I think the only legit bounties are the projects that launch thier private sale on good exchanges like binance and bittrex but the problem is some IEO on exchanges don not run a bounty campaign.
Since their private sale held on popular exchange, they don't need any supppoter or bounty hunter's help to promote their token.
Bounty hunter always get a bad position about it, we can't complain and developer sometime not really care about it even a lot of people complain that not get paid in bounty campaign. But maybe if a lot of bounty hunters make complain, their trust can be affected and they will make any action.
If they didn't give any answer after they have promised when the time they will pay, just make an scam accusation about them. So people will stay away from any of their token or project