Consider that the most critical bugs found by black hats probably never make it out into any market, open, shady, or otherwise. They're probably kept internal to the team that found them, or sold/traded directly between organizations with long relationships.