A $7,000 bounty for eavesdropping and TCC (app permissions) vulnerabilities. Insulting.
I'm reminded about the Apple Music passage in the After Steve book, where Apple tried to fuck over musicians just because they thought they could get away with it (zero royalty payments during Apple Music trials, so the trial was 100% subsidized by labels and artists), before walking it back. The executives are clearly far more concerned with bad PR, and not guided by values or principles.
Even if by another party that could have found it before?
Are you saying that this particular bug would not be worth more than $7000 in one of these markets, or are you questioning the very existence of these markets?
Well, let's try to conceive it. Our state level actor is now in possession of an exploit that lets them eavesdrop on a target when they text-dictate or activate Siri, while wearing particular Apple headphones. After getting the target to install a specific malicious app from the App Store. And to run it. And to give it Bluetooth permission. And to make sure to restart it whenever they reboot their phone or the phone kills it for any reason. The value of this as state-level actor surveillance malware feels a lot closer to $0 than $7000 to me but I'm happy to hear a different conception of how this might work.
Remember, at the end of the day the sale is to the government and they have big pockets and less common sense.
Shadowy brokers are buying up impractical exploits by mistake seems like an essentially unfalsifiable claim.
I would happily pick $7,000 clean money over $50,000 dirty.
Google The NSO Group for an example, and that’s just private entities. nation state actors are a whole other market for such things.