Vulnerabilities go to the highest bidder. With our military budget being what it is, I'm pretty sure we could outspend anybody out there. If you start offering millions of dollars for serious vulnerabilities, people will turn them in, including employees of foreign intelligence agencies.