The numbers are accurate. Browse through past payments to researchers participating in the Internet Bug Bounty, Pwn2Own or Microsoft's mitigation bypass bounty.

I don't have any good citation for the going rate for a high value vulnerability on the black market, but if you look I'm sure you'll see it can easily enter the mid six figure range.

As for "good vs evil" - I never used those words. Morality is a word I used because it provides a useful context against which to judge legitimacy. You can fairly say it is unethical to sell vulnerabilities for the explicit purpose of exploitation. I don't particularly care to color it this way; I disagree with such actions but I still respect my fellow colleagues who do it.