In my experience the hacker usually gives you the exploit for free, but asks for a bounty. Aggressive ones may say that you should pay them with the implication that they may name and shame you if you don't.

Others will only agree to share the exploit if you pay, but I have always assumed that it is a scam or a really lame vulnerability.