IMHO GSoC should be something like "hacktoberfest" where contributors for the projects get paid for squashing bugs not for making "new features" nobody needs.
The convenience of GSoC is that the students get to intern with pay on open source projects. If squashing bugs is the only goal, then going through their bug bounty lists and getting paid for it really is just picking a company on that list and doing it yourself. However, with a Google program behind it and the company's agreement, I'm sure the amount paid will be higher and/or more consistent.
Including my old link [2] for security/bug vulnerability discovery as well, since you get paid for these by the companies based on bug fixes or discoveries.
I was thinking they would work on one project the same mentorship scheme, but I can see how it might devolve without keeping the education in mind.