A person can do research on a salary. Demanding money because you found a 0-day in their software is scarily similar to blackmail.<p>There is plenty of room between blackmail and research. A professional researcher can draw a paycheck and release exploits as found.