I'm somewhat skeptical that this is actually going to be a big / common issue. Introducing vulnerabilities, in such a way that they're both effective and look

I'm somewhat skeptical that this is actually going to be a big / common issue. Introducing vulnerabilities, in such a way that they're both effective and look like an accident when one of your coworkers (or in the case of open source, anyone else) looks at your code, seems like it'd require a pretty advanced skillset. Such a person is probably better off selling that skillset directly and legally by finding vulnerabilities in other peoples' code. Not to say that it won't happen on a targeted basis, but a legal market for "discovered" vulnerabilities doesn't seem to add much incentive when the act of intentionally introducing them is likely illegal already, and they'd be paid the same regardless.