If I had to desposit 10$ to report a vulnerability to a company that could get their entire production/business to halt, I'd publish the exploit.