> also wouldn’t know how to contact a “state actor” even if they wanted to.

That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.

How does this work in practice? What systems are in place to prevent someone selling an exploit and then turning around and disclosing it properly as soon as they have the money, potentially getting even more money through legal channels? Is there some sort of escrow?

> Am I too optimistic? I feel like most regular people I know wouldn’t sell this off.

Probably you're just used to a relatively good life, not a bad thing :)

Image being able to sell this off for $20,000 (although I think you could ask for more, seems to be a really bad vulnerability) in a marketplace, for >90% of the world that's a pretty good amount of money that you could survive a long time on or add a lot of additional quality to your life.

Opportunity makes a thief. Most people does not have the opportunity even if they have skill.