I think this is spot on : " the users of Steemit have the ability to reward such nobel actions and in a sense fund their own bug bounty program "

I think if the bug is high risk it should be presented privately. Once resolved I do feel that he Steemit whales should upvote a the post of the person who found the bug as a reward.

This will ensure that the community is the real winner since the combination of community votes and the whale votes increase the rewards!

Cool post!

Cheers