Only a subset of security professionals are researchers, and only a subset of those are vulnerability researchers / exploit developers, and only a subset of those have arms dealer-like roles where they hoard and/or sell and/or privately deploy zero-days they discover.

I think it's totally fair to critique the arms dealers (and that's indeed undeniably exactly what they are), but only a small percentage fall into that bucket.

You could easily argue they are doing the opposite, in that they close down potential weapons and responsibly disclose them so that they are fixed and patched. Add to that, a majority of computer security work is revolved around improving infosec. A further point, I doubt infosec researchers are the types that run a deprecated microsoft web browser.

The main argument I have heard is it’s less finding exploits and doing real security and more mind numbing auditing and checking boxes not to prevent attacks but to cover your ass when they happen.