Steam already had published bug bounty rates. An individual doesn’t have much negotiating power, especially since it’s so easy for it to come across as blackmail. It’s a low rate for a person who probably spends weeks finding an exploit and where bounties like this are their primary income.