Projects would rather get hacked than pay bounties, Web3 developer claims