I can imagine many ways this can backfire. The simplest is - the targeting you’re assuming may not be actually what happens. It may be that some number of bugs released are different and have an unintended side effect. What gives this private organization the right to run this experiment on all of us? Will they assume liability?