How about a law where someone who finds an exploit can claim a bounty against the company selling the product or publishing the website? This doesn't address th

How about a law where someone who finds an exploit can claim a bounty against the company selling the product or publishing the website? This doesn't address the machine learning part, but it does address IoT and security generally.