measuring programmer productivity is notoriously difficult. Does james, who shipped 20 features without testing thoroughly provide more value? or does joe, who patched a security hole in that time and avoided disaster? what about jason, who facilitated communication between them, and kept the infra going so their changes could go into prod without issues?

How do you do that in practice though? You won't know the engineer is a con-man until after you have spent $$ and months into the process. Then you are in the position of trusting nobody.