Crypto security audits and bug bounties are broken: Here's how to fix them

Are crypto auditing incentives designed to make the client happy rather than deliver bad news? What happens if you don't pay out bug bounties?