Well, the project were offering a grand 382,945.41% APY in 12 months, that's 3,829 times of your initial investment in one year, I wouldn't be so surpised if they have something fishy like a rug-pull build up being cooked in their kitchen.
Speculation aside and facts first, were there an agreement or statement before the bounty begin that the bounty allocation is USD-pegged, in sense that they're allocating 300,000 USD for bounty that's paid in SAFUU, and not --let's say-- 20,000 SAFUU regardless of its USD rate? If the former is what's agreed, then their decision to burn some of the bounty tokens in assumption that their rate will continue to grow up and matched 300,000 USD on distribution date is rather justified. If it is the later though, it means they cheated agreements.
While for the burn address, just like what
witcher_sense said, is there any proof or prior statement that they possess or didn't possess the private key of the address? Although it is rather unusual for project to create their own burn address instead of using the existing usual 0x00...dead, theoritically, it is not impossible to create a wallet "without" private key.
Looking for some materials to get a better insight for this case, I stumbled upon several methods proposed by some people in reddit. Two of them were by creating a paper wallet but not storing the recovery key, and the other is, although the method's efficiency is yet to be confirmed by anyone, by
"tweaking" a generated address:
I created a burn address for a BSC token by taking a normal BSC wallet address and replacing all of the actual numbers with 0's.
example:
portion of Original address: 0xc20bd506d3ac925e5e....
portion of Address after I altered it: 0xc00bd000d0ac000e0e...
[...]
So, unless there is a proof or prior statement about the existence of the private key for Safuu's firepit, we can't just accuse them of possessing the backup for said address.