Companies do this because customers have already demanded it or because they know companies will demand it.
It's expensive, but it helps you land customers, which pay you enough to cover it.
It's expensive, but it helps you land customers, which pay you enough to cover it.
Furthermore, I wouldn't underestimate the positive press that having a third party security firm assess your product and share the results publicly. VPN Services have been under special scrutiny lately so I think something like this makes total sense for Mozilla, regardless of the cost.