But it should be possible to brute-force bc1 addresses since those also use private keys, if that's not implemented that'll make yet another good science fair project or even a Google Summer of Code project

Neat idea. I might give that a go and submit a pull request or fork BitCrack with that function. It should be possible.