$10 000 still seems a bit low for a truly serious vulnerability. Could Google start a vulnerability bidding war and simply make it too expensive to acquire them?