You're welcome to point out the inaccuracies as you see fit. Everything I've said is from my experience as a security engineer working with and interacting with tech companies throughout the tech industry.

My personal view is that I would not sell vulnerabilities on the black market, and I most likely would not do it through a third party broker either. Also note that I presented options as game theoretic decisions - I personally have ethical considerations, but those do not color the very obvious career differences for so-called "whitehats" and "blackhats" (terms which I do not enjoy but which are good enough for a discussion that doesn't require so much nuance).