Someone that hacks your systems won't be limited to a single system or domain, I don't see why your reward system should be.

Would you rather that vulnerabilities discovered in out-of-scope systems be sold on forums instead?