This falls apart pretty quickly. You're assuming that people writing open source software WANT money or WANT fame. If they want those things, then they should ensure they go about it the proper way. As with nearly everything in life, nobody is just going to hand it to you.
As for people finding exploits being "bad". If I volunteer to build a playground, then forget lag bolts on the walkway, is the person who reports the missing bolts bad? Or are they GOOD because they informed someone who could fix it before someone got hurt?
Finding exploits, and paying for exploits isn't a bad thing. There's a reason we have inspectors. What you can very much argue is a bad this are companies like Zerodium who use those exploits to intentionally harm everyone else. It would be the equivalent of a lawyer hiring an inspector to review every public playground he could find so that he could file lawsuits.