Bitcoin contributor Pieter Wuille recently commented on Reddit:
Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that if they're adopted inside Bitcoin, and elliptic curve crypto is (completely) broken, new money can be printed. On the flip side, it does mean that the privacy of anyone who used CT in the past is unaffected. Alternative formulations of CT exist for which this is the other way around (perfectly binding but not perfectly hiding), where money can never be printed (even if the cryptography is broken), but privacy can be retroactively lost. There is currently a discussion on the mailinglist which of these is the better tradeoff (it is mathematically impossible to have both perfect hiding and binding).
Which design did Monero choose to use?