A 501(c)(3) is expensive in legal work. Unless they can find a pro-bono lawyer, this puts the plan in the "it takes money to make money" category.
Then it still doesn't guarantee they'll increase donations without marketing so people know about it. Until Heartbleed became public, I imagine few companies were aware that OpenSSL had so few resources and such great needs. They definitely need to capitalize and hope the bad press doesn't make large companies seek an alternative.
I dunno. I think the effort might be worthy of the EFF's time if they have the expertise. I don't think that any EFF donors would be upset that they spent time to help OpenSSL setup a non-profit.
Then it still doesn't guarantee they'll increase donations without marketing so people know about it. Until Heartbleed became public, I imagine few companies were aware that OpenSSL had so few resources and such great needs. They definitely need to capitalize and hope the bad press doesn't make large companies seek an alternative.