Do you pay a software engineer for their time based on your revenue or his skill?

Be somewhat competitive to what such developers could get on the black market. Discounting the ethics.

Surely a bug on Chrome is worth more than a bug on Firefox.

Should I be competitive with meth manufacturers when I buy prescription cold medicine from a pharmacist?

To the extent that meth is a viable substitute for cold medicine you'll have those prices correlating.

But more to your point: the bounty is more similar to an auction. Once you sell the bug to the software producer the black market has no more use of it, assuming it gets fixed.

Supply is constrained, so competition is on the demand side.

On the drug example demand is constrained, if you're the only buyer. So competition happens on the supply side.

This is the complete opposite in every facet. I struggle to think of a worse analogy.

Bad analogy, but yes actually. This is one reason people buy drugs from illegal online pharmacies - cost. I

Mostly based on revenue - or at least that is the way we are going.

That is why you see equivalent skill levels being paid differently in big tech compared to other places.

And why you see millions in salaries at some big techs Ai hiring.

Not at all. Corporation always pays as little as possible. Unless we are talking about CEO levels...

If you don't have the revenue, you don't pay them at all, because you don't actually employ them.

It's really no secret that higher revenue means higher potential pay/more devs...

Both - these are the two sides of the market, aka supply and demand.