What's stopping zerodium from not paying after all the details of a zero days is provided for "verification"?

Zerodium offers bounties for zero day attack, but in their process, they get access to the entire attack for testing and verifying. What's stopping them from not paying a bounty or making a low ball offer? "Up to X ammount can be anything in between their top offer and zero.

cybersecurity zerodium