I think that's because these people are on the business side of exploits, not the technical side. So really the most important quality to have is a lack of scruples, not any kind of insane technical talent which might inform proper infosec.