If the reporter is trying to get paid for not reporting, that's blackmail. If the blackmail is organized, it's a racket.

Plus, if the attack surface is huge and/or fractal, you will never run out of exploits. The more you pay people to find them, the harder they look...