interesting idea, to an extent this already exists with bug bounty programmes that a number of companies have in place.

The risk is where either the company doesn't have a programme of that kind, or where the value of the bug is substantially higher to the offensive industry, than the product company...