I'm not here to discourage you about bounty campaigns that are managed by the project team themselves, I'm here to tell you that you need to be extremely cautious, I've noticed that team managing campaigns themselves is not good
---snip
I'm sure I'm not the only one who sees things this way, or am I?
However, we cannot generalize that the bounty campaign handled by the dev team itself always ends up being a scam or disappointing. From the important points discussed by the OP, the risk could be greater because they are free to change the rules and allocations arbitrarily without regard to justice for bounty hunters. But what else can we do? bounty campaigns handled by external managers also don't necessarily guarantee that we will get a fair reward, it's all back to the dev team's decision.
Escrow is one solution to uphold justice, so this can be considered as well.