Would it be possible for a miner to create extremely erratic payouts (i.e. distribute the bounty to a million addresses) as a vector of attack? Or would the block be rejected in that particular case for being over 1MB?
Right. The generation is just an input to a transaction. The value of the input is found by the block subsidy + fees. The outputs follow the normal transaction rules.
The generator could easily create a giant generation transaction with tons of garbage outputs. You don't even need to pay out to the outputs: 0-value outputs are valid. The block size is limited to 1MB, though.