Other answers here have addressed the security side of expired certificates. I am going to address the bug bounty side of the question.
If the company's main/live domain(s) has an expired certificate; they sure know about it. Their tech support switchboard has just lit up with all these calls about an 'insecure site'.
If there is an expired cert (or even a self-signed cert) on one of their domains it is likely abandoned, or for internal use only.
Publishing a bug bounty scheme implies that the company is going to pay money for bug reports.
By being up front about excluding this sort of thing they stop low-effort scanners going over their domains and submitting bug reports. This has a dual effect of not wasting the company's time and preventing the negative publicity on social media when the person submitting the report doesn't get a payout.
As bta points out in their excellent comment, it would also be trivial to scan domains, save the current expiry date and revisit them again at that time in the hope of getting a bug report out of this.
I would also think that the restriction is merely a type of gatekeeping. If a seasoned security researcher spotted an actual problem; say a % of a company's application servers used an out of date version of - for example - OpenSSL that allowed downgrade attacks, that researcher would know enough about the situation to submit a report anyway. My guess is that such a report would be paid on, whatever the policy says.