Many vendors do this covertly through HP (with ZDI) and other intermediaries. The problem is the government will always pay more, or even offer to let you sell

Many vendors do this covertly through HP (with ZDI) and other intermediaries. The problem is the government will always pay more, or even offer to let you sell it back to the vendor and buy it from you (in the case of things that are difficult to field upgrade like routers). The people cranking out high volumes of exploits for the customer are sitting on huge multi-year contracts worth tens if not hundreds of millions of dollars. They don't want to go play in some utopian regulated marketplace, they just want to make money and protect America.