"We have no clue how our software works, so we will sue you".

It's a disaster from any point of view. Also ineffective.

They could easily designate not 10M, but 100M for bug bounties and simply solve their problems.