Or just distribute your source with the binary, and opt into the no liability regime.
But this does not solve the question: who is going to pay for an expert to read all the source?
The vendor's competitors, of course.
Humiliating the competition is good marketing.
LOL nope. Humiliation works only on the level which target audience understands, like performance benchmarks. Security exploits are much more esoteric and tend to result in mudfights. It already did many times, like, how many businesspeople responsible for procurement have accurate understanding of spectre/meltdown/rowhammer vulns? Why do you think AMD isn't using it for marketing against Intel?