it really depends, if you do your homework, a practice almost every day, put the time, no it pays really well. for example one time i found a bug for private program and they pay me 3000$ (XSS, session hijack, account takeover)
but it would definitely be hard for someone who does have family, and should pay the rent and stuff, for that kind of person without any background knowledge(programming, Linux, networking, ...) , yes it would be hard.
i am single (i don't like to settle down, it's not that fun LOL), the government pays my rent (i live in Germany), and yes, you can make good money. but as i said, you have to work, and most importantly you have to love hacking (or programming, which was my first interest), other than that it will be a disappointment.
now you might ask why am i here then? bug bounty is good, but the big problem is that you have to put a time to find something, so you will waste a lot of time, and maybe sometimes you will find nothing (it will happen), but i said to myself that it would be much better to make some online business to makes good amount of money (my plan is to hit 1000$ per month, that's my short-term goal, then we will go higher).
so for that goal, i am doing research to see what are the option.
something that i find that catches my eyes is indiehackers.com, damn i love this site. check it out.
hope you find it useful (and if you have any idea for making 1000$ per month, love to hear)