Google directly competes with the grey market for vulnerabilities. They are competitive in a bunch of different directions:

* They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable).

* They don't require you to actually build a reliable exploit chain.

* They pay up front, not in tranches.

* They work with essentially all comers, unlike the grey market, where you're generally subcontracting to sell your first few.

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

Well, someone did decide to tell google about this in exchange for a thousand dollars (albeit unclear how much the money was the motivator). Doesn't that mean the market did decide in google's favour?

Blackhat markets will always be able to pay better. Selling to Google though you aren't chancing jail time.

They would be broke quick.

In the past I would have thought this would incentivize finding bugs that might never be found. However it is now clear that all bugs that can be found will be found. So this makes a ton of sense.