More security researchers are selling vulnerabilities to the highest bidder rather than disclosing them “responsibly” to the vendor whose products are affected.