Maybe they're just ethical by nature. If I could make lots of money by breaking the law or doing something un-ethical I (and in fact the vast majority of people) still wouldn't do it. Money isn't the only motivating factor.
So it is very well possible these exploits would have been worth more on the open market and still the team decided to work on this in a white-hat setting because they are simply good people.
If you consider just your own "best economic interest", a lot of "jobs" like drug dealing, prostitution, fraud etc. are good choices. Morals, not wanting to go to jail, and a concern for your own physical security are non-economic factors that make these bad choices in most people's view. Blackhat hacking falls pretty much in the same category; selling exploits may perhaps be technically legal, but I wouldn't bet my paycheck that you couldn't be put behind bars for aiding and abetting in a criminal offense or similar.
But building a reputation as brilliant whitehat surely confers significant economic benefits as well.
Given how juicy the VMWare escape is, I'd also just start dumping ~/Documents/ on any machine that you escape out from the guest OS on. Who knows what they'll have?
It's mostly going to be boring, so you'll want to automate this, but infect enough machines and you'll hit easy scammer pay dirt- PII on millions of people, despite regulations that prohibit doing this. Credit cards, social security numbers, phone numbers, addresses. From there, it's just a felony or two away from either stealing people's identities yourself, or selling the list in a scam forum (for way more than $100k). There are all sorts of juicy data that you might find; VMWare isn't something that most people run, and maybe there are other monetizable bits of data.
Assuming you don't find the scammers' wet dream in stolen data though, you're reduced to trying to monetize from other ways. Desktop popups, DDoS for hire, cryptolocker-style data-ransom, using the machine as a host for sending spam.
It's 2017 and it really sucks that spam is still such a huge problem (Gmail's spam filter is only so effective because Google's team works hard, and is good at their job, not because the problem has gone away). As a spammer though, this means it's still lucrative enough that there's some non-zero amount of money to be made. Due to the VMWare escape involved, you'll have fewer problems with machines in your botnet going offline (how often do you reimage a VMWare host compared to the guests on it?) and can charge more money to use it too.
There are established scammer networks that can already monetize a botnet and selling your botnet and its capabilities to them might be easier than monetizing yourself, but at some level in order to make money you start getting some serious exposure that will land you in prison for years if you get caught, plus you'll eventually start working with scary people that will kill you if it suits them.
I'm also not convinced a VMware escape is something people get killed over. The leaked "Hacking Team" data shows exploits aren't worth that much more on the market (iOS being a big exception).
The trouble would be how to prove the exploit works without also revealing how it's done. The best bet would be to demo one or two out of the three exploits required to work, then talk business in exchange for the third.
Anyway, it's been done before by guess-who:
https://www.mitnicksecurity.com/shopping/absolute-zero-day-e...