This is why the bad guys win so often. Even companies that do pay bug bounties often pay very little compared to what exploits could be sold for.