How does this work in practice? What systems are in place to prevent someone selling an exploit and then turning around and disclosing it properly as soon as th

How does this work in practice? What systems are in place to prevent someone selling an exploit and then turning around and disclosing it properly as soon as they have the money, potentially getting even more money through legal channels? Is there some sort of escrow?