The game theory comes into play, if you found a bug that could empty maker's vaults for example, you better do it right now, otherwise, someone else will before you and you wasted all your time/energy.

Exactly. This is precisely why there aren't (or at least, in a rational world, should not be) any undisclosed zero-days in crypto. If you're aware of an exploit, you're just going to exploit it immediately unless you're willing to let someone else exploit it in your place.

There is a large amount of money at stake with these exploits and it doesn't make economic sense to let one sit around.