In this situation, the hypothetical 500 were on the short list from tens of thousands of applications and some intermediate number of first round interviews. This was the 'short list' and we could have likely hired any one of them successfully.

We didn't do the 'hand them a project for a day' btw, we met them in person and had them go through a half day of panel interviews. Still something that ideally they would have been compensated for beyond food and our gratitude.

I'm on the side of paying candidates that go through any substantial interview effort, I just think that the regulatory details are going to select for folks that are less privacy-focused and are already established in the domestic economic infrastructure. I used to work in a bug bounty program where we paid out to researchers all over the world and the logistics of it was a pretty major issue (and resulted in a non-negligible portion of the submitters forfeiting their payment).