[theshrike79]

It's a token game.

Let's say finding a security issue takes 10M tokens. If one company has to pay for it, they most likely won't bother. It's purely a cost/benefit thing for them.

But if you have an open source project, you might get a 1000 people looking at it, each only has to spend 10k tokens to find the same flaws.