This is never going to work. Sufficiently many of these people are going to find maintainers' home addresses and send them death threats and the likes. If you see how badly some people flip out just because their PR is rejected, it's going to be much much worse if their PR is rejected and their money is taken.

The worst case is that someone loses out on $10, no? How does this work if the maintainer is the swindler?

So I pay $10 when your bot fucks up?

That's called theft. And for what, one banana?