then server side vulnerabilities should not be reported, instead sell the data, more profitable

Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.

Most people don't want to be felons.