"Due to the success of the program, vulnerabilities are harder to find. The amount we are paying is now insufficient to justify the time and effort for most researchers."
One year later....
"The largest security breach ever has occured for Google...."
Google is shutting down the program due to its improved security measures
In its email, Google states that it is closing down the program because of the "overall increase in the Android OS security posture and feature hardening efforts." This has led to researchers submitting fewer vulnerabilities than before.
In its last annual report, Google claims to have stopped 2.28 million privacy-violating apps and banned 333,000 malicious developer accounts. Last year, it also announced major improvements to Google Play Protect, including real-time scanning for Android malware. More recently, it bolstered the Play Integrity API with in-app signals to prevent fraudulent activities.
These improvements are evidently working and have led to fewer vulnerabilities being discovered in Android apps and the ecosystem.
Seems kind of weird to me that they want to shut down a program because it worked too well. "we don't want to pay people to find problems because we don't have to pay them as much lately"
In its email, Google states that it is closing down the program because of the "overall increase in the Android OS security posture and feature hardening efforts." This has led to researchers submitting fewer vulnerabilities than before.
Vulnerabilities are found, which shows that the program is successful and needed.
No vulnerabilities are found, no money will have to leave Google.
Keeping the program will reap the benefits from both no. 1 and no.2 while closing down the program only enables no.2.