The catch is, if you sign up to the Apple Security Research Device Program then every bug you find on that device has to submitted that way. Therefore if you choose to 'only forfeit the bounty' as you put it, then:
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"
"Apple reserves the right to immediately end your participation in the Apple Security Bounty program if you violate any of these terms and conditions as determined by Apple"