[mrRandomGuy]

With rewards this low it's no surprise that people sell bugs and exploits to often shady third party entities.

[drtgh]

"How I Found a Vulnerability to Hack iCloud Accounts and How Apple Reacted to It"

https://news.ycombinator.com/item?id=27564236

Spoiler: Apple didn't paid him (even they tried to fool him a second time). By reading HN its not the first time it happens..

[tptacek]

Nobody is selling XSS bugs to NSO.

[_kbh_]

with the huge uptake in Electron apps you can probably sell an XSS if you can turn it into a RCE.