The incentive is to discover them but exploit them after the switch to the new chain
> The incentive is to discover them but exploit them after the switch to the new chain
You're always at the mercy of a hard fork that "fixes" the bug after the exploit.
This is what the Ethereum classic fork was about.
The one nice thing about crypto is that if there are bugs, the incentive to exploit them is large, they will get found quickly.
How the problem is dealt with after the fact (e.g. ETH Classic hard fork) i.e. the governance model is the real interesting part.