Wordfence sells access to information on how vulnerabilities would be exploited that they know about before they even notify developers about the vulnerabilities. They do that through firewall rules available to Wordfence Premium subscribers. That hardly seems like responsible disclosure.

Bug bounty programs are an inefficient way to improve the security of WordPress plugins. What would be better to do that would be a combination of having more incentive from WordPress for plugin developers to properly secure their plugins and more security reviews. We have seen instances where a developer would pay out more for finding one vulnerability, than it would cost them for a review that would identify the vulnerability and the other security issues in the plugin.