From the reports coming from a number of places, I'm absolutely sure this is what is happening. People want the glory of finding a named bug, perhaps they believe some more widely useful reputation gain is heading their way if something that their bot finds is actually massively significant. Though it isn't limited to 500 repos, they tell it to just keep going after every one it scans.
This is unironically suggested as a way to 'get in the door' both in bootcamps and 'spammy' universities.
Combine this with a growing sense of being "left behind" and a highly publicized collapse in software jobs coming any day now and any proof of contribution is highly prized. So why not?
Its kind of appalling that people think this is an acceptable way to behave