It has that effect (good PR) as well, but I think tptacek is correct that this will have an effect on the 0day market. If you find a vuln and build an exploit

It has that effect (good PR) as well, but I think tptacek is correct that this will have an effect on the 0day market. If you find a vuln and build an exploit you get to choose whether to do something risky (criminal liability, others might find the same vuln and take the reward, the bug might not live long enough for you to make more than $1M from the black market, further criminal liability from money laundering you ill-gotten gains, ...) or... take the easy $1M. Which would you do? It's obvious. Now, by keeping these 0days off the market, Apple also gets to further burnish their reputation. It's a good play no matter how you look at it. Of course, first Apple needed to be fairly certain that there aren't tens of thousands of vulns left to patch!