I got a 5k payout from google for serious OAuth bypass bug. I'm not a security researcher so I wouldn't have any idea or really desire to sell something like this to a Government.
But I'd have to agree that if I had publicly revealed the bug Goog would have lost magnitudes of business or possible fines from governments far above and beyond 5k.