Can a hacker's extortion demand ever be paid off as though it were a bug bounty? Or is that a step too far?