I do not disagree. In fact, I personally have a problem with all non-vendor vulnerability sales, for the same reason.
I just think we should be clear that exploit developers, brokers, and users don't actually create vulnerabilities; software companies do.
I also think people should give Adobe a little bit of a break --- not much of one, but a little. Adobe got monstrously successful off a codebase that largely predates the concept of software security. It's a nightmare problem for them, and they are working on it. They should work harder.
15 years ago a pretty sizable chunk of the industry thought heap overflows weren't exploitable for code execution, so I don't think that's the right interval.
I just think we should be clear that exploit developers, brokers, and users don't actually create vulnerabilities; software companies do.
I also think people should give Adobe a little bit of a break --- not much of one, but a little. Adobe got monstrously successful off a codebase that largely predates the concept of software security. It's a nightmare problem for them, and they are working on it. They should work harder.