Steven Walbroehl, a former bounty hunter, said that companies would sometimes downplay bug discoveries and not pay bounties, claiming that the bugs were not critical.