In this case what are the firms who pay these rates doing with the information?

Defensive work (e.g. IPS vendors) well after they've got their early day protection they can just sell on to the vendor.

Offensive (e.g. "cyberweapons" ugh I had that term). well that's the point I'm making that whole industry is bad for defensive security as it involves keeping vulns secret as long as possible, so they can be used by them.

Gov's have to make a choice whether that's an industry they want to encourage, be neutral to, or discourage.

But given this line of thinking is one you'd disagree with, what option for addressing the problem do you prefer?