You don’t think there are folks with content they’d very much not like to be directly associated with them? Comments, videos, likes, etc
You are imagining a potential market, the exploits are priced against markets that are real and pay out today. Security researchers aren't traveling salesmen going around to every shady character on the internet and pitching them on the potential of a new criminal enterprise.