When does bug bounty hunting actually hurt security postures?

Bug bounties are praised as crowdsourced security, but some argue they create perverse incentives—researchers hoarding vulnerabilities, duplicate work, or companies using them to dodge real security investment. Have you seen bounty programs actively make products less secure?