The person who finds the exploit can give it to some shady group and make lot more money and then if the exploits become public it damage MS. In the examples you mentioned can you do the same?
There was a story on HN a while some guy just got 100K for an Apple account takeover exploit. That is a huge exploit, paying 100K is peanuts for 2 Trillion dollar company.