That makes absolute sense to me, and I agree. However, it doesn't cover the aspect that some bugs are directly monetizable without needing to be sold (as was t

That makes absolute sense to me, and I agree. However, it doesn't cover the aspect that some bugs are directly monetizable without needing to be sold (as was the case with my Google XML Sitemap exploit). Of course, there is a risk to directly monetizing such a bug too, but the risk calculation is then different.