Add in a mandatory portion of device sales that goes to responsibly-disclosed vulnerability bounties. It'd have some side effects of centralizing handset manuf

Add in a mandatory portion of device sales that goes to responsibly-disclosed vulnerability bounties. It'd have some side effects of centralizing handset manufacture into a few manufacturers (and core component suppliers) and/or pushing more into using straight-Android. But making the economics more aligned with security, in a predictable way for the manufacturer, seems important enough to make the trade-off.