Paraphrasing something I read elsewhere but is so true: defi systems have a natural bug bounty program where the payout for a critical is the entirety of the funds under management.
Except when there are, like the Ethereum fork to recover the DAO hack.