In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternativ

In theory a large corp netsec team may buy zero days vulnerabilites and then either disable the affected systems or engage directly with the vendor. Alternatively depending on how nationalistic someone feels NSA could be a eithical buyer for them as well.