If you're working on Facebook security, is that a bet you're willing to take? People might mostly take what they're offered, have it amount to a decent enough

If you're working on Facebook security, is that a bet you're willing to take? People might mostly take what they're offered, have it amount to a decent enough hourly rate but there will be that one in ten or one in a hundred unhindered by moral and/or legal considerations. At that point, it turns into a cost calculation - perhaps it would indeed be cheaper to pay tenfold or more to a hundred people than have just one sell their bug/exploit/whatever to another, more interested buyer?