There's a difference between underground criminal gangs discovering exploits and selling them on black markets and being able to raise capital, have legal protection, etc. while you hire experienced developers to find exploits that you sell to despotic regimes like Saudi Arabia.
I suspect that distinction is what you are missing.
I suspect that distinction is what you are missing.