The hypothetical question Facebook should ask is:<p>&quot;If the security researcher did not disclose the RCE, but instead sold it to highest bidder, how much would that likely pay in this situation?&quot;<p>Paying security researchers to properly disclose is a way of financially encouraging the right behavior. While it may be tough to stomach a large payout for responsible disclosure, do you really want them considering the alternative? It&#x27;s like tipping in a restaurant to ensure food quality.