This is The Way. It also inevitably comes with a written agreement.

What always gives me pause with this is that my open source software comes with no warranty and I don't want to compromise the license terms. So nailing down the written agreement (what are they going to do with it, and what are they attempting to hold you liable for?) is an opportunity to address that.

(Full disclosure: haven't had this come up in well over a decade.)

$5k also doesn't sound like a whole lot of money to give a guarantee about the security of your FOSS code. Unless I were already rather confident about it, it would take work for me to convince myself about it to the extent that I would be willing to answer a hundred questions on someone else's form. $5k isn't necessarily that much of a compensation for that kind of work, unless you're also gaining something from the work itself (e.g. from reviewing the security of your code for its own sake).

I don't know if filling and returning these kinds of forms can have any kinds of legal implications, but if it did, even potentially, there's no way I'd do that for $5k unless I were in absolutely dire need of that money.

I'm not the person who said "$5K". But it's not about the money per se. Mooting a number is the polite way to say you're open minded to assisting them.

Maybe they'll share a third party audit of your code with you.

Maybe the written agreement reiterates "you agree to be bound by the license terms and FULLY UNDERSTAND AND ACCEPT ALL LIABILITY" and you still get $5K.

Besides at the negotiation stage it's still plus costs. It's been a decade, but if you spend $20K on lawyers and liability insurance and they pay you $25K, you still make $5K.

More than $5k. Just recovering your associated costs will be a couple $k:

A lawyer to help negotiate a contract. If you find someone who is familiar with OSS and isn’t in a big firm, this might be $1k or so.

Liability insurance.

Any incorporation costs if you choose to incorporate, which (in the US, I’m not a lawyer, and this is not advice) you should seriously consider if you start making money from independent work.

Throw in a bit of support and you might get paid fairly well. Keep in mind that the fact that you got asked for this means that someone wants to use your work enough that they asked the procurement department to set it up.

If they accepted the offer this would actually create a Catch22 chicken-and-the-egg situation where they can't employ a non-approved vendor.

Also: filling this in can open up liability. There's no way you get it all accurate, and in the event of a breech (e.g. supply chain attack where you get hacked leading to them getting hacked) they could argue that you misrepresented or didn't comply with your stated response.

So the 5k which could never be paid might also not be worth it.