There's a clear cut between selling it to Google and selling it to black hats. White hats mostly have a career in cyber security and they will not disclose a vulnerability to a compromised party regardless of the price. Cyber security researchers will like having their name attached to a CVE or a fix in a well known open source project which is arguably worth more than 20K to them. If someone finds out you sold a vulnerability, or exploit, to a hostile party, your career is over.