Additionally it could convince the CIA to distribute less weapons.
The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).
Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it.
Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA?
This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/