Realistically in my experiences every large company has "skeletons", which are primarily known to insiders and of which outsiders have less knowledge.

Be that a product which is known not to have as rigorous a security regime as others, or perhaps a service which is considered "legacy" and not developed actively.

When offensive companies start hiring people to get access to that information to use against their prior employers, I think that's not great for overall security.

I didn't think I was implying that keeping flaws secret in the long term was desirable, I don't think it is.

Also whilst I agree it's naive to suggest that only insiders know most flaws, I feel that it's also reasonable to suggest that insiders have information which would be useful to attackers, and that could be tapped by hiring them.

As I said originally that was just one example of where I think potential problems could arise from "vulnerabilities as a product", but I'd be interested to hear what you think are the downsides to vulnerability markets.