the maximum proposed here is 1 million APE which is a very reasonable range given the stakes involved! To be clear this particular AIP is focused only on securing AIP-21 I would agree with you that a general bug bounty program should also be considered. It may make sense to do so for projects of a certain size.