I expect the pay awards are based on the various OSS foundation thingies lobbying.

But protecting dev environments makes sense. Think how many supply chains an attacker can compromise if they can get at random dumb developer machines...