The only "process in the market" for this kind of work is individuals or companies breaking random things in public to build their reputation as auditors (e.g.

The only "process in the market" for this kind of work is individuals or companies breaking random things in public to build their reputation as auditors (e.g. homokov), or selling vulns. But as you point out it's only really awesome when you follow the Cryptography Research model: find a new class of attack, develop the countermeasure, package (potentially patent) the countermeasure, then make scary demos of the attack to get responsible parties to buy your countermeasure. In this case the mitigation is so simple ("don't use PKRNG; avoid RSA, Inc. going forward.") that it's not monetizable, so it's really only for reputation points.