> If this researcher actually had a vendetta, I'd expect them to just sell the remaining zero-days to the highest bidder.

How do we know they didn't? It's called zero-day because Microsoft wasn't aware of the exploits until today. It doesn't mean that no other parties have known about them.