I don't know if OP is advocating it, per se, but those marketplaces do exist. Even though it's morally and legally wrong, there is an incentive to sell exploits

I don't know if OP is advocating it, per se, but those marketplaces do exist. Even though it's morally and legally wrong, there is an incentive to sell exploits to the bad guys, instead of disclosing them to the company. The analogy is a bit off, as 'a beer' is relatively good compensation for the disclosure of the car-key vulnerability, compared to the potential black-market value, and the potential loss to the owner. With this example, it's more like you told your neighbor about his forgotten keys, and they gave you a nickle and a pat on the head.