Some companies that operate bug bounty programs for tech businesses have been perverted into schemes to pay bug reporters to keep silent — permanently.