Well if the programmer was internal and regardless of whether acting on his own or for a state would be subject to both criminal and civil liability. I am not

Well if the programmer was internal and regardless of whether acting on his own or for a state would be subject to both criminal and civil liability. I am not a lawyer but it has been done before in other companies. The US government wouldn't protect this individual likely, as they want deniability. They may assist in trying to reduce his criminal charges but even that is remote. If it is found that the person actively engaged in selling access to the exploits it also changes what charges could be brought from my understanding. And if they were paid by another government it could get even worse if they are found.