Maybe they want to incentivise selling exploits to nation states, not patching them?