Actually it's the exact opposite. Bug bounty programs have constantly proven to be among the most effective ways of increasing a company's security, no matter how "pitiful" the payouts are. The overwhelming majority of people, when they find an exploit, are going to to do the right thing and report it, not sell it to the highest bidder. Increasing the bounties isn't really going to help, considering there's always going to be a hacker group or government entity willing to pay more.
Of course the programs aren't going to be a replacement for real product security teams, but they were never meant to be.
Of course the programs aren't going to be a replacement for real product security teams, but they were never meant to be.