It is definitely arbitrary but part of me does think that surfacing such a bug is pretty important and if the monetary incentive was higher then we would have more white hat pentesters out there.