Any insurance that can only pay out in proportion to the premiums already paid in seems like a red flag. That's a savings account and not a genuine transfer of risk. Unless the bug that triggers a payout is extremely circumstantial, it seems likely that any single claim would trigger a flood of claims, so I don't buy that pooling premiums received makes an insolvency-inducing run less likely.
Yeah, the way I presented the idea above, it's closer to a cooperative than an insurance company. I think it's more important for the buyers of the "insurance" to get their bugs resolved quickly than it is to receive monetary compensation, so the purpose of the payouts is really just to incentivize OSS developers to resolve bugs quickly by penalizing their future earnings if they fail to do so.
But if real insurance with real payouts is desirable, then that's solvable by raising capital for the fund in an ICO and directing some of the cash flow to investors. If I'm not mistaken this is how you'd start an insurance company today: you'd need to meet some capital requirements before being allowed to sell insurance to the public and you'd do that by raising money from investors.
