A 501(c)(3) is expensive in legal work. Unless they can find a pro-bono lawyer, this puts the plan in the "it takes money to make money" category.

Then it still doesn't guarantee they'll increase donations without marketing so people know about it. Until Heartbleed became public, I imagine few companies were aware that OpenSSL had so few resources and such great needs. They definitely need to capitalize and hope the bad press doesn't make large companies seek an alternative.