Only a subset of security professionals are researchers, and only a subset of those are vulnerability researchers / exploit developers, and only a subset of tho

Only a subset of security professionals are researchers, and only a subset of those are vulnerability researchers / exploit developers, and only a subset of those have arms dealer-like roles where they hoard and/or sell and/or privately deploy zero-days they discover. I think it's totally fair to critique the arms dealers (and that's indeed undeniably exactly what they are), but only a small percentage fall into that bucket.