I think the issue with bounties is that to do a proper bounty program you want a third-party escrow agent that can decide when the issue/request has been addressed sufficiently to warrant paying the bounty. I don't think GitHub wants to be directly in that business as a third-party escrow agent hiring people to review issues/requests versus changelogs, but they probably could find ways to help people find such third-parties in the Sponsors flows.

What GitHub could enforce is that someone creating an issue is a sponsor.

This would then be a checkbox in the settings of the repo “only sponsors can create issues? Yes/no”

As I understand it, this is something that the OSMF enforces - not sponsor, no issue creation.

Moreso: what if someone fulfils it in a fork.