While I agree in principle that sounds like incentives leading to a new economy similar to that of copyright and patent trolls. Just scan for known vulnerabilities in [commonly used software] used by [mom and pop shop] and demand a payout. The result is a dead web consisting only of big-corp-hosted sites as no one else can ever keep up with the infinite array of vulnerabilities.