The legal/ethical question is important, but I was just stressing OP's point about the disparity between bug bounties and what the actual exploits are worth. IANAL, but for the specific cases I mentioned (nation states and vendors who work with them), I think the legal aspect would be very different from selling it to regular black market cybercriminals (I used the generic "black market" in the first part of the original comment but I was mostly talking about those two cases).