True, but they usually do by the time they say that you will be paid.

I think the argument that a black market sale of an exploit won't necessarily be as clear cut is still valid.