They sell a subscription service that provides access to a catalogue of their exploits to Government groups (law enforcement and intelligence agencies mostly). Depending on the company the list of acceptable clients will vary, some of these firms sell only to the federal agencies of 5-Eyes nations, others will sell more broadly than that, some may only sell to ${Local SIGINT agency}.
Government groups might do any number of things with these exploits but typically law enforcement will use them to execute warrants to help in their surveillance of suspects. Intelligence agencies may use them in the same way (pursuant to their authorizations). Other customers might somehow try and defend friendly networks with the information but this doesn't work.
I'm not sure what in particular tptacek objected to but my guess is characterizing them as part of the Government. The Government isn't keeping any secrets here (except for the ones they're presumably contractually obligated to keep by Endgame / VUPEN / etc) and the vulnerabilities have been discovered before the Government has contracted with the supplier.