> researchers shouldn't hold bugs for ransom or demand high payment.

why? google removed don't be evil off their charter a long time ago. why shouldn't security researchers also seek to maximize profits?