maybe that is their goal. Perhaps they want to (or already are) use(ing) tor to hide their own activities from the NSA. They want to make sure what they are doing is truly as secure as it claims to be and if not motivate devs to make it so. After all, it seems it would be cheaper to offer this small reward than to have to pay full time employees to help keep their activities secure from prying eyes.

It likely will, open source projects are nearly impossible to stop. The SSL/TLS standard and their associated standards and clients has shrugged off a number of attacks at surprising speeds. Patch cycles are measured in hours or days apposed to weeks or months.

If the attack is particularity disastrous then there will likely be a large fork. But once a project is started and a community built its unlikely that force will be stopped.