“Someone capable of finding a serious vulnerability is probably capable of exploiting it themselves. They don’t need a buyer.”

I’m responding to this. I would assume the list of people able to find a vulnerability is much much greater than the number of people willing to do a one off heist with it.

What you’re responding to and what you’re saying it says are two different things.