For example, will we see these companies hiring ex-developers and testers from software product companies, as they might have inside knowledge of where products are weak.
Two things.
First, you're not clear on why this would be a bad thing. The flaws are there whether insiders out them or not. The implication in your comment is that we'd be better off with those flaws kept secret. Obviously, we'd all be happier if the vendor outed their own flaws, or if a non-"mercenary" researcher outed them for public consumption. But even private vulnerability sales have the effect of eventually burning the bug.
Second, it's a little naive to think that most flaws are known only to insiders. In fact, the advantage insiders have in getting full access to repositories is probably dwarfed by the advantage attackers have in committing entire careers to studying exploitable bugs. For most competent researchers, lack of source code is just a speed bump.