In that case they are asking you take all the risk, so you need to factor that into the cost. You need detailed specs up front in order for this to be at all sane (developing the specs could be an independent project without obligations on either side). Depending on the uncertainty left in the spec, you need to have a multiplier on the expected costs. 5x, 10x, or even 50x would not be out of the question if there is sufficient uncertainty.
Yes this costs the company more, but if they expect you to take on their budgetary risk, then you are providing insurance, and that is potentially worth a lot more than the actual development.
How are you "forced" to swallow costs, unless you're contractually bound to deliver in 10-12 hours? If your client wants an estimate, by all means, give them a non-binding estimate. If you find yourself over-running your estimates, then it's either your fault or the client's fault - why should you have to bear the cost in both cases?
We do have a "non-binding" estimate, but they can't turn the wheels in their large organization to get payment for more than the high end of our non-binding estimate. And no one takes us seriously if we say "probably 10 to 12 hours, but this kind of work occasionally has problems that will balloon the costs to 20 hours."
Why would you not just say 10-20 hours then? If you know that you're going to wear any overrun costs, you owe it to yourself to give the estimate based on the worst case, NOT the average case.
Edit: If you think that 20 is a real outlier, and 12 is your average case, use something like the PERT formula: ( [Optimistic] + [4* Realistic] + [Pessimistic] ) / 6
If O=10, R=12 and P=20, that would give you an estimate of 13 hours.
Edit: Usually, just stopping when the hours run out isn't a good choice either, because most of the projects we have won't provide a partial solution. It's all or nothing. Example: converting data between two formats. We discover a quality issue when we've run out of time, so the converted data is unusable.