"But wait, can't a project maintainer always just merge their own Closes ## Issue and empty the bounty to themselves?"
Indeed they can. This would of course be wildly exploitative, and deserving of community-wide reprimand.
Luckily for us, GitHub is built to provide an inerasable history of Discussion and collaboration - with Discussions still retrievable as evidence of wrongdoing even after they are deleted.
That's why we are building out a reputation system for contributors to review the organizations they work with, and working on establishing a Kleros court to mediate complaints.
In the meantime, we must rely on the standards of etiquette and human decency to prevent such malpractice.