The tokens spent to find the vulnerabilities will cost money, and the attackers will usually find themselves more financially incentivized to spend money on finding the vulnerabilities than the defenders.

Yes but… they pay it once and then reuses the exploit