Most firms DO invest (lots of) money into security for their customers, bounty programs were not invented by Zerodium. Brokers like Zerodium will inflate the p

Most firms DO invest (lots of) money into security for their customers, bounty programs were not invented by Zerodium. Brokers like Zerodium will inflate the price of 0 days, for sure. Maybe this will be an incentive for 0 days researchers to dig deeper. At least they'll be richer. But maybe it will cause more harm than good: it's a market place for exploits, and Zerodium will look like a 0day Wallmart to hackers. "They can sell to the companies themselves, domestic and foreign governments, or terrorists": I consider the only ethical option is the first one. If you're really concerned about security for consumers, can you tell me how you're trusting "domestic and foreign governments, or terrorists" to protect your security when they're buying exploits? They're buying exploits, holes in security: they don't buy you more security, it's the exact opposite. I'm sure companies are much more concerned about security for their customers than any other actor. Why would a third party want access to exploits if not to defeat the security put in place by the company? 0 days researching is essential to plug holes, not to punch holes. Only the target can plug holes, the other "customers" only want to punch holes.