Ideally, you should find a bonus listed on the trade or an IEO that is verified by a reputable broker.
However, just in case you can find a bonus program listed on the trading, it does not mean that it is a good bonus program. I can for example, coinhe cheated bounty hunters and Function X so far has no intention of paying.
Unfortunately, we never know which one will be the one, and I'm pretty sure whales or insiders don't know either.
My point is - I don't think the lesson is "think before joining bounty/airdrop/whatever" it is more of a "think if you need to join it beucase you partially donate your personal data"