I think the idea is to pay these people to deduplicate and verify vulnerability reports, so the responsibility doesn't fall on every maintainer to do that same process individually, so they can focus on fixing the real bugs.