[wnevets]

>Why would cybercriminals not just report the bug and pick up the cash from Google?

Probably because they're not the ones actually finding the bugs.