Who says it isn't being used in a legitimate manner for high profit potential? It seems you can offer up subscriptions to zero days for millions in annual fees and never have to worry about prosecution. Just so long as you aren't the one doing the actual hacking (your clients in the government will take care of that).