It won't do that for free, companies (and open source maintainers) will have to pay for the tokens used finding vulnerabilities in their own software. That increases the cost of releasing the same product/feature/amount of code vs what it was before.