You could and still can sell vulnerabilities to companies that sell exploits to governments. You might hear of heavy ones getting to the public once a decade, but you can expect them do be traded and used much more often and used on targets much more important than us all the time.