There are very legit bounties, just recently a bounty that was hosted by Criptix https://bitcointalk.org/index.php?action=profile;u=255027 (LatticeExchange) paid people good $$$ for their work and it should tell you that there are paying bounties. And what then is bug finding? Is that not a BOUNTY? I think we should all do what works for us