Facebook announced this week that its paid out more than $5 million to 900 researchers in the five years since it implemented its bug bounty program.