That 3 million figure is operating under the assumption that the hacker already has good market research (he is building something people want) and distribution (he is able to get it to those people). Those are the costs you are paying for when you work for a large company.
If the hacker does not have those two things, it is quite likely that he will generate significantly less than 3 million dollars of value.
I suppose the missing factor here is what PG refers to as simply "hard work". By that, he means all the other stuff you have to do to run a successful business besides hacking. He's oversimplifying by putting it that way, IMHO.
If the hacker does not have those two things, it is quite likely that he will generate significantly less than 3 million dollars of value.