Mandatory bug-bounties from major vendors

I argued when we discussed this at work yesterday that this would possibly crush small and medium sized code development shops. A small company with a very popular app could get financially wiped out by a high “bill” for vulns from the government.