Bekrar said Zerodium is testing the vulnerabilities to make sure the exploit meets the competition rules, meaning the prize money has yet to be paid.
So it's a million dollar prize, but it's not been paid, and likely never will.
Well, you might expect that a 7-digit reward would be subject to appropriate validation of the submission.
Considering the effort that likely went into the attempt, and the motivation to ensure it’s paid, I expect it will be paid. (If YOU worked hard to win a million-dollar prize, I’m sure you’d see to it you were paid.) Kneecaps come to mind as a motivational subject.