There could also be a reverse bounty paid as a salary bonus to the devs if there is no security bug found in N months. A "code quality bonus", if you will. Though only to encourage quality control.

Intentional bug creation should probably result in firing, unless it was done under duress.

Oh yeah, the old cobra effect. However, you could only pull it off once. I am sure a postmortem of all related design and commits would be done, correct?

Also, FAANG level salaries are pretty high for anyone involved with that type of code, right?