Comment by cjbprime

The tokens spent to find the vulnerabilities will cost money, and the attackers will usually find themselves more financially incentivized to spend money on finding the vulnerabilities than the defenders.