There is basically zero consequences for whatever fuckups you do, thus no incentives for companies to pay for vulnerabilities.