It does not address the fact that, with such a policy in place, there would no longer be a reason for them to spend time/cash seeking these vulnerabilitie

It does not address the fact that, with such a policy in place, there would no longer be a reason for them to spend time/cash seeking these vulnerabilities. If you are not looking for vulnerabilities then others will do and find them.