A DLL is canned functionality, so if you include a vulnerable DLL in an application, that application is by default vulnerable.

If they default on the conditions, then there are provisions for council to negate the lease.

I’ll tell you all about it, but let’s eat first. I’ve had nothing to eat. Although I was offered some raw squirrel. Canned pudding, that’s what I want. I’ve been dreaming about it.”
She hauled out a can and feverishly worked the can opener. She didn’t wait for a dish or spoon, but thrust her hand in and scooped some into her mouth. Then she stood transfixed, overwhelmed by the wonderful sweetness of it.
She was crying when she said, “I’m sorry, I’ve forgotten how to be polite. I’ll get you guys your own can.”
Sam hobbled over and scooped some pudding of his own, following her lead. “I’m way past polite myself,” he said, although she could see he was a little appalled by her wolfish behavior. She decided then that she liked him.

Many of our most valuable contributors consistently identify significant vulnerabilities that may never make the front page, but both avert major exploitation and secure considerable compensation through our rewards program.

The attraction is that we are not bogged down in tremendous bureaucracies and processes that make it difficult to get the transactions done.

The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it.