(c) there are so many undiscovered vulnerabilities that it doesn't make sense for them to offer a decent payout