I thought that too, at first, but it seemed to blatantly illegal to believe. Going by their site, it's mostly for government agencies against other agencies?[1] I'm not proficient enough at law to comment on the legalities of it.
Another possibility I had in mind is that they want to get paid by people wanting to fix this vulnerability on their systems. eg, company X will have to come to them if they want their IE browsers to receive the patch against this bug.