Sure, you could look at it like that. But their only value would be if they're never (or at least very rarely) actually called upon to act as a scapegoat. All the incentives would be for them to do their job and keep compromised software out of the ecosystem. Of course nobody is perfect, but they couldn't be flippant about it and survive.

What are the incentives? I honestly can’t tell.

The only reason for such an organization to exist is to be a clearing house for software; adding a stamp of approval that it is safe and hasn't been compromised by nefarious actors. Such an organization might be funded by a trade association, industry sponsorship, or direct fees to end users. But whatever the case, it would be strongly incentivized to fulfill its mandate or else lose credibility, reputation, influence, and financial rewards.