It's the "up to" part of the reward offer that will make sure those who have discovered the bugs for their own personal gain through selling patches, won't be telling DJI how those patches do their thing.
If they sell the derestriction patch for say $200 then they only need to get 150 customers and they've matched the maximum $30k bounty offer, after that they're laughing.