There are too few benevolent actors with the time and energy to do this. That's why bug bounties are important to inventivise it. Otherwise the only incentive that exists is the one for the bad actors: theft.