You forget to normalise by the uncertainty of payment in the blackhat case and the probability of repercussions.

Not to mention the possibility of selling the same thing to multiple black hat buyers.