Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.

Most people don't want to be felons.