Crowdsourced pay-per-bug model is reactive. Penetration tests are preventive. So you're talking about different services for different stages. Penetration test is performed prior to release to production and after released, a crowdsource pay-per-bug takes place to stimulate white hats rather than black hats.
Well described. Also pen testing is a litmus test that can be done anytime. The vuln models are for the few companies who have made great progress in squishing bugs and are taking a very proactive approach. Unfortunately that is still a small percentage of companies
