> But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth.

I'd point out that part of the reason the grey and black market pays so well is because it is that type of market. You have to pay people extra to look past their morals and a risk premium against potential reputational and legal consequences.

That said, the gap is probably not just that.

It seems like by definition it is.

Someone could sell it on the black market, sell it to Google, or just move on with their life and not sell it.

I don't know what this is worth on the black market, maybe I'd be scammed by even trying to sell it. Maybe I don't want to be a bad person. These are all things that go into the prices