Exactly. They are bribing the project leads so they can then say that scanning is approved and voluntary.

Perhaps they chose maintainers from OSS projects they scanned?

I'm not defending Microsoft's market tactics, for obvious reasons, but we do have to consider that anyone can publish whatever insignificant code as OSS and become an "OSS maintainer" out of nothing.

They have to draw the line somewhere. Nowhere they draw will make everyone happy.