Security-related bug bounties are usually more of a PR event than an attempt at outsourcing a security audit. The message they want to communicate is "Our software is secure, and we are so sure about that that we bet $$$$$ that nobody can find a vulnerability".
When a company places a bug bounty, you can assume that they have also read the standard literature about penetration testing and already patched those vulnerabilities you can find with the usual methods. When any newbie could find their bugs, the bug bounty offer would become both expensive and bad for PR.
When you enjoy looking for vulnerabilities, want to improve your skills and want to do good while doing so, you might want to consider to support some smaller open source projects which don't have the resources for a security audit. You won't get paid, but you will collect valuable experience.
A "proof of concept" for a vulnerability is a demonstration which shows that the bug happens. This illustrates that the bug is really there and not just a theoretical approach. It can be a series of instruction like "Click here, click there, enter that, cancle then, click there, clap your hands twice and you have administrator access". Or it can be an exploit: A program which causes the application to misbehave when executed. When proving a bug with an exploit, it is usually expected that you don't just deliver the binary but also the sourcecode and an explanation how it works.