But until now there are still no complaints about the identity of the bounties who report that something is billed so I hope they are just a scam of bringing money and don't sell ID data on the black market, of course this will be a lot of worrying apart from BCNEX is a scam project until now.
It's hard to use that as a proof that bounty KYC is not sold on the marketplace, mainly because not everyone pay attention to their KYC data and which bounties they send their data to. I'd rather assume that all of my data are prepared to be sold anytime on the internet, instead of relying on optimism.
Just like how people should prevent sickness instead of relying on treatment. The cost is way bigger.