It's my understanding that those groups buying exploits in plain view sold exclusively to government agencies which is why their business model was tolerated.