That's my thought too. I'm sure most of the so-called "security experts" who like to talk about how important privacy and security are for the rest of us are sitting on lots of 0-days.
Right? There are too many valuable bug bounties and interested parties for people to divulge the best exploits. Those are all probably still in the wild and will remain that way until the right buyer appears.