Yes I believe they report and pay their taxes Software exploits are not munitions and are not controlled, they are not illegal to find, they are illegal to use

Yes I believe they report and pay their taxes Software exploits are not munitions and are not controlled, they are not illegal to find, they are illegal to use, hence why there is a market for selling them to sovereigns who have immunity from criminal liability Shifting liability until it reaches the end user who has no liability or takes the risk