I am more interested to see how a major Rust project holds up when its attack surface gets larger. So the question is when does Servo get added to the Pwn2Own
That's a political question, not a technical one. Things get added to Pwn2Own when its sponsors (including, e.g. Google and Microsoft) push for them to be added, as far as I can tell.