The market concept is nice for the reasons you listed, but doesn't it add an incentive to introduce obfuscated exploits into code then sell an exploit to them later?