Major bugs in smart contracts can cause the system to stop working rather than handing anyone billions. As such people can discover such issues without disclosing them in much the way infrastructure can be vulnerable without people damaging it.
https://github.com/openethereum/parity-ethereum/issues/6995#...
https://www.cnbc.com/2017/11/08/accidental-bug-may-have-froz...
*very large being required for significant money to be at stake, making say 10k illegally from a short is hardly going to inspire a lot of effort.