Adversarial red team bug bounty hunters to the rescue? What if there were a law that any responsibly disclosed security vulnerability must be rewarded with a b

Adversarial red team bug bounty hunters to the rescue? What if there were a law that any responsibly disclosed security vulnerability must be rewarded with a bounty based on the damage the vulnerability would have caused? Combined with immunity from hacking charges for companies that have a license to operate this way (and strict monitoring on those companies). It's self-funding, self-enforcing, and as a bonus, trains more "cyberwarfighters" nationally. Maybe the market can solve this problem.