The tokens spent to find the vulnerabilities will cost money, and the attackers will usually find themselves more financially incentivized to spend money on finding the vulnerabilities than the defenders.