If someone had an exploit like that, there's money to be had by exploiting it in secret and/or selling it to people who do that. Why would they post it online for you for free?

Because they are a researcher that wants to show that rolling your own crypto is bad. In other words back up the orthodox opinion with a PROOF and not just groupthink.

This is an argument that suggests we should all keep on using SHA-1, since, after all, there's no public exploit.