It's hard to win bidding wars with nation states. It's even harder to make such victories matter: after all, they can always switch to doing security research a

It's hard to win bidding wars with nation states. It's even harder to make such victories matter: after all, they can always switch to doing security research and exploit development in-house. Instead of trying that, we're catering to two groups of researchers: 1) Those who are not comfortable with the idea of selling weaponized exploits to the highest bidder for unspecified offensive purposes, and 2) Those who like to find bugs, but don't want to spend days or weeks to develop reliable, weaponized exploits for resale. As it turns out, there are thousands of extremely prolific researchers who fall into these buckets; the number of "black market" players is much lower than that. The reason why all of this matters is purely probabilistic: all this scrutiny limits the number of remaining vulnerabilities that can be leveraged for nefarious purposes, and limits the lifespan of any already-known 0-day bugs. Now, having said all that, your comment is more applicable to vulnerability reward programs - which this isn't :-)