Yeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.

Sure. I'm not saying that the moral way is just as profitable as the alternative; only that it exists.

Agreed, exploits on the deep Web pay 10x what the big bounty programs do, the mismatch is laughable