[commenter98456]

For private individuals that move makes sense. For nation states (with the exception of NK because they're so broke) - a financial incentive isn't enough.

Petya with M.E.DOC is a good example, Russians burned quite a significant attack infrastructure there. They could have sold that access to "someone" but the price (under $1mil in my opinion) isn't worth the sort of chaos it caused in ukraine (majority of companies in ukraine used that software I believe). My point is, if they did backdoor kasperskyOS, it wouldn't be used for a financial end, maybe to "show off" their capability, a retaliation to your government screwing with them,etc... but certainly not a financial end.

Frankly, I'd be happy if governments stay out of securiing civilians when it comes to computers and the internet. Tired of being a meaningless pawn to be discarded whenever convenient to do so.