It does not, but it changes the set of people looking to buy them and the way in which they’re used, both of which impact the general market for vulnerability sales — and additionally, re-aligns some present attackers to defenders.
Security researchers, strangely enough, seem to care who they sell to. If the NSA stopped buying and only the UAE was interested, I expect we’d see some firms move to other business models or targets for “research”.
> "It does not, but it changes the set of people looking to buy them and the way in which they’re used, both of which impact the general market for vulnerability sales"
There is no shortage of oppressive regimes with incredible amounts of money at their disposal. People who are in it for the money don't honestly give a shit who pays them. You cannot eliminate the market for this stuff. The only option is to create better software.
Security researchers, strangely enough, seem to care who they sell to. If the NSA stopped buying and only the UAE was interested, I expect we’d see some firms move to other business models or targets for “research”.