You're only looking at it from one end of the funnel. On the other end you have security researchers who are active in the cybercrime underground markets, and

You're only looking at it from one end of the funnel. On the other end you have security researchers who are active in the cybercrime underground markets, and have the same opportunity to buy stolen data as the criminals themselves. So disclosure can come from the other end when it becomes apparent that a certain company's data is being sold, and I think almost all of it does get sold eventually, even if the initial hacker has a way to exploit it privately: After they've finished, they can make money selling the leftovers.