While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance).

The other blockers of course being that I have neither the skills nor the time to find such flaws in the first place!

It is true that there are people out there who do have the skills, and the time, and would be fine with selling their results to third parties, so maintainers (particularly those publishing widely used projects), would do well to treat people who practise safe disclosure with sufficient inducement to keep doing so.

I am not 100% sure, but wouldn't that be a crime under the laws of many countries? If someone left their car unlocked with keys next to your house. Will you also steal it and sell it to somebody?