Does it make sense to exert so much effort in preventing these events/learnings by well-intentioned organizations?

No, but what I think you’re seeing is many people who do not believe OpenAI is a well-intentioned organization. For example, their view might be that if we did as you suggest and incentivized OpenAI to search for these weaknesses, they would, but then they would not “privately disclose them ASAP”. (And I think they’d have a point worth engaging with, when you consider how they slow-rolled the HuggingFace stuff so much that independent researchers were still discovering new instances of the attacks months later).

What else can you do with (what you believe is) an inveterate bad actor?