There has been a change in the industry. Actually the change happened much earlier, Microsoft just couldn't remain in denial anymore and were often criticized f

There has been a change in the industry. Actually the change happened much earlier, Microsoft just couldn't remain in denial anymore and were often criticized for ingesting so much free research while giving nothing back. Basically if you had a Microsoft vulnerability and you decided that you wanted to disclose it, you would just go through a broker (such as ZDI) who would deal with Microsoft, but also pay you. The other options were full disclosure, or selling it on the grey market. There are major vendors who are far worse than Microsoft, such as Oracle and Adobe, but they are just so bad that nobody expects anything of them. tl;dr Google has been making them look bad.