> This is understandable since ASUS is just a small startup and likely does not have the capital to pay a bounty.

ASUS is not a small startup. It simply and only minds the money they suck FROM customers. There is no other way around to push money TO customers.

But the real point is: how much would be worth selling such an exploit to a malicious agent? Likely more than USD 0.00.

But then again, ASUS doesn't mind about that. Sad truth.