A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.

It can only show you if someone has used an exploit against this server.

It cannot even show that. The server can lie (trivially).

The block chain can't though once the coins are transferred

That assumes the key is actually on the server.

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

The server could simply be running a patched PHP.

Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking. Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".

Are these 500$ laying on a ground for anyone to take?