Aren't these sorts of zero days worth a LOT of money? He didn't go all the way to RCE, but he probably could have gotten there. It makes you wonder how many people are out there with Tavis' skills who just farm these things and sell them to the highest bidder instead of making us safer.
Fortunately there aren't many with Tavis's skills, but you don't need to be that legendary to find these sort of vulnerabilities.
Assuming you can identify (skill) and safely sell (anonymity expertise and market savvy) a zero day, the demand for them is quite limited. (The only reason the price is so high is that the supply is just even lower.)
Additionally, if you have the market savvy to extract the maximum value for a 0day, you will quickly realize the feast-or-famine nature of unsavory income isn't great for a stable home life. You might eventually want a day job, and you can't exactly say "Oh, I helped that virus penetrate your network three years ago that you just detected last month."
So most people with Tavis's skill levels typically aren't in a hurry to go rogue.
And the ones that do are more interested in compromising bitcoin exchanges and drug marketplaces on Tor Hidden Services than they are in spreading malware to end users. (That's the advertising industry's shtick.)
Yea, I'd also have to say very few. A researcher of that skill level is pulling a very comfortable salary. A lot of the work that comes with that salary requires you to have an above board reputation. If a company is hiring you (or your parent company) to find vulnerabilities in their product, they need to be sure you don't have a conflict of interest.
