It's worth noting that not every bug is a security-critical bug. Similarly, not every crash is a security-critical crash.

Sometimes you can exploit a bug to give you something, sometimes it's just a plain old bug.

People only pay for the security-critical ones.