Your principles will be gone by the time the 10th company starts to sue you for a public disclosure you did in good faith.
There's a reason why nobody wants to use their real name and creates new aliases for every single CVE and report.
Principles are discrepancies with the law, they don't exist. If the law dictates a different principle than your own one, guess what, you'll be the one that is in jail.
Whistleblower protection laws are a bad joke, and politicians have no (financial) incentives to change that.
Not going to name names, but someone I know was happy when his workplace was acquired by a bigger company from another country. He was the most senior developer, had done the heavy lifting, the product was did a good job for its happy users and the buyer would continue that, and last but not least, he'd be rich. Admittedly part of the agreement was a handshake, there had been so much to do, they'd worked insane amounts of overtime and some paperwork had been deferred…
He got nothing. No money at all. The CEO pretended to have forgotten every verbal agreement.
You only need to experience that kind of thing once to change your mind.
TL;DR: a random stranger is most likely a nice and honest and principled human being. A sufficiently large population of random strangers behaves approximately like a population of amoral(ish), rational(ish) economic actors. If your process involves continuously drawing a stranger at random from a population, then you can't avoid taking the economic view, because you eventually will draw a crazy or malevolent or economically-rational stranger.
--
GP wouldn't sell their discoveries to the criminals. But would they consider selling them to a third party as an intermediary, perhaps one that looks very much above board, and specializes in getting rewards from bug bounties in exchange for a percentage of payout?
I don't know if such companies exist, but I suspect they might - they exist for approximately everything else, it's a natural consequence of specialization and free markets.
Say GP would say yes; how much work would they put into vetting the third party doesn't double-dip selling the exploit on the black market? How can they be sure? Maybe there is a principled company out there, but we all know principled actors self-select out of the market over time.
Or, maybe GP wouldn't sell them unless starving, but what if agents of their government come and politely ask them to share, for the Good of their Country/People/Flag/Queen/Uniform/whatever?
Or, maybe GP wouldn't sell them unless starving, but what is their threshold of "starving"? For many, that wouldn't be literally starving, but some point on a spectrum between that and moderate quality-of-life drop. Like, idk, potentially losing their home, or (more US-specific I guess) random event leaving them with a stupidly high medical bill to pay, etc.
With all that in mind, the main question is: how do you know? How does Google know?
The reason people take an economic view of the world is because it's the only tool that lets you do useful analysis - but unlike with the proverbial hammer that makes everything look like a nail, at large enough scale, approximately everything behaves like a nail. Plus, most of the time, it only takes one.
GP may be principled, but there's likely[0] more than one person making the same discovery at the same time, and some of those people may not be as principled as GP. You can't rely on only ever dealing with principled people - like with a game of Russian roulette, if you pull the trigger enough times, you'll have a bad day.
--
[0] - Arguably, always. Real breakthrough leaps almost never happen, discoveries are usually very incremental - when all the pieces are there, many people end up noticing it and working on the next increment in parallel. The first one to publish is usually the only one to get the credit, though.
But you probably wouldn't take the time to write up a nice report and send it to Google either if they didn't pay. Or even try to find the bug in the first place.
(But yea, I think lots of people would sell exploits to criminals for enough money.)
Yeah I think this is the part that never gets mentioned. I'd like to think that most people wouldn't immediately go to selling on the black market, even if the pay is better it's just too risky if you get caught.
But if you don't pay people enough in the first place... then they're just going to spend their time doing other things that actually do pay and your bugs won't get caught except by those who are specifically trying to target you for illicit purposes.
I mean the alternative isn’t that you are selling it on the black market, it’s that you expose the issue in a blog post and the first time google knows is because one of their employees see the post here on hacker news.
You are essentially been paid to fill out forms and keep your mouth shut.
Your principles will be gone by the time the 10th company starts to sue you for a public disclosure you did in good faith.
There's a reason why nobody wants to use their real name and creates new aliases for every single CVE and report.
Principles are discrepancies with the law, they don't exist. If the law dictates a different principle than your own one, guess what, you'll be the one that is in jail.
Whistleblower protection laws are a bad joke, and politicians have no (financial) incentives to change that.