[yieldcrv]

Yes I believe they report and pay their taxes

Software exploits are not munitions and are not controlled, they are not illegal to find, they are illegal to use, hence why there is a market for selling them to sovereigns who have immunity from criminal liability

Shifting liability until it reaches the end user who has no liability or takes the risk