No, because it incentivizes the company "not to look very hard" for evidence of abuse. A company can claim EVERY bug was never exploited, and nobody can dispro

No, because it incentivizes the company "not to look very hard" for evidence of abuse. A company can claim EVERY bug was never exploited, and nobody can disprove them. There is an inherent conflict of interest there.