Comment by n2d4

But you probably wouldn't take the time to write up a nice report and send it to Google either if they didn't pay. Or even try to find the bug in the first place.

(But yea, I think lots of people would sell exploits to criminals for enough money.)