I don't know what will really happen if the company is reported through their smart contract audit company atleast they could contact them and advise them about the situation cause if their bounty participants dont cool off it may affect the project in the future. But their investors did get their tokens.
@bold: That's where we will fail even if we report as investors have got paid and all companies just care about investors and not bounty and other reward participants. It's like the rules are decided by the company and they have the right to choose not to pay.