>On a completely unrelated note, if I were a security researcher, I'd start being extremely mindful about to whom I'm selling zero-days.

Unless you're dependent on the money, responsible disclosure is probably the most ethical way.