Someone decided to tell Google about this in exchange for an unknown amount of money, chosen unilaterally by Google at a later date, at which point the market value of the vulnerability is $0.

There's no way money is the motivator.

Money is not the only coin to pay someone in.