This type of exploit is extremely time consuming to produce, and doing so does not guarantee payment.
The security researcher then, out of frustration, throws up their hands and either decides to sit on the vuln, or simply publish it - neither of which is a good outcome.