This is somewhat of a tangent but I think hoarding zerodays should be illegal for an individual, company, or state. It would be seen as highly irresponsible if someone held back critical information about a vulnerability in a dam, I don't see how a zeroday is any different.

What is especially stupid is that the US does this as well, while they're the ones who are the most vulnerable. Just look at the debacle with WannaCry. These attacks come from countries who have a lot less to lose than the US, yet the US insists on throwing stones from their glass house.