AFAIK this is similar to Zerodium's business model, except they sell the zero day exploits to governments [0].

From their website [1]:

> "We pay BIG bounties, not bug bounties"

[0]: https://en.wikipedia.org/wiki/Zerodium

[1]: https://www.zerodium.com/