If they value responsible disclosure, they should pay enough to make it worth the effort. They need not compete with black market prices.
There are more incentives than money. Some people like the thrill, some like the "thanks!" from the person they helped, some just like fucking around with web security.