Exactly. This is precisely why there aren't (or at least, in a rational world, should not be) any undisclosed zero-days in crypto. If you're aware of an exploit, you're just going to exploit it immediately unless you're willing to let someone else exploit it in your place.

There is a large amount of money at stake with these exploits and it doesn't make economic sense to let one sit around.