Maybe some people are ethically against selling to an organization that then resells the zero day to governments instead of, you know, fixing the problem.
One option is life changing and the “ethical” side might not pay enough to buy a gaming PC. Meanwhile the executives at the companies that claim security research needs ethics are making millions of dollars selling insecure apps. It’s like a church asking poor people to tithe IMO.
I actually think it would be better if there were no laws regarding the sale of security exploits. Everything should go onto an anonymous marketplace and the companies that have affected products should have to pair fair market value for bug discoveries.
Skimping on security and guilting researchers into being ethical is a total scam.
* The money otherwise goes to the pockets of completely-useless C-suites.
* The exploit is likely out anyway.
* Nation state actors may indeed prevent yet another 9/11 attack. In worst case they don't use it to spread ransomware.However, the idea that security researchers are guilted into "being ethical" while the (rich) executives for massive, multi-billion dollar tech companies are saving money on security, plus skimping on paying security researchers fair value when bugs are discovered, frustrates me.
It's hypocritical for big tech to expect "ethical" behavior from security researchers when it's a lot closer to "let us take advantage of you" IMO. If it becomes a debate about ethics, I think every time an exploit is sold to a company like Zerodium it's primarily the fault of the tech companies that are exploiting security researchers.
As you say, clamoring for ethical behaviour at all in this context is terrible and completely missing the point.
If someone still wants to put in all the work, that's great, submit the vuln and reap the good karma but they shouldn't expect more, even if the org they're reporting it to promises otherwise.