You should keep in mind sites like Google, Yahoo, Amazon have a couple (of thousand) of servers. They can afford to "open the doors" to everybody because, as M15K pointed, their resources are not limited.
There are a couple of reasons they might do be "open":
1. You can gather performance statistics.
2. You can test the system for stability (if server X goes down, server Y has to take over, etc)
3. Probably many more reasons I can't think of.
In small/medium/large companies you usually end up using Linux/Unix server, Apache, Nginx, LigHTTP, Jetty, MySQL, PostgreSQL, Oracle and etc. Sites like Google(giant) create their own platform and their own software solutions - web servers, databases, proxy forwarders and etc. So leaving "the door open" for the public actually helps them to constantly improve their security and platforms because every "hacker" in the world will try bringing them down. A few of them will succeed and usually they end up working for the company or receive a satisfying number in their bank accounts :)
In my opinion it's not safe for you to "open" everything if the company you're working for is not creating most of the software solutions from scratch (web servers, databases and whatever else your company needs). Even then it's a bit risky especially if you're managing sensitive data.
i.e. could publishing such a statement put your site at more risk than leaving it out?
It doesn't matter if you say "We'll not sue you if you tell us where the breach is".
If somebody wants to hack you - he'll try doing it whether the statement is there or not. But if it's there it may sound more like you're inviting them in. So probably you'll get more hackers trying to hack your server.
However, what measures should a site already have in place before embarking on such seemingly risky endeavor?
You will need to figure out a logging mechanism, or monitor the actions that are being made on the site and server. Also a full backup of the site/server is a must.
Generally I wouldn't recommend leaving the server "open" especially if it handles sensitive information like credit cards, payments, medical information for patients and etc. It's better for you to hire a team of hackers with a proper contract. Otherwise you're risking all that information going in public.
I can't go in more details as this topic is HUGE and there are many things you need to consider before going "public":
- Do you have the money to do that?
- Do you have the resources? (servers, security teams and etc)
- How far can you limit the damages a hacker can make to your system? I.E. If a hacker hacks into your server what access will he have ? Will he be able to connect to your database and retrieve/store/update data? Is your data encrypted ? Will he be able to decrypt it? (and so on)
- Can your security team find how a hacker exploited your system?
- Does your security team have the skills to fix problems that may occur ?
- Probably many more questions that you need to ask and answer before you decide.