For anybody interested in p2p secure messaging, there is an interesting, relatively young project http://cwtch.im/ aiming to be a metadata-resistant, decentralized messenger. The UX is a bit clunky and I definitely am not going to try forcing my friends using it (as I do with Signal), but for tech-savvy communication this definitely looks promising.
Yes, it is no different than OPSEC with heavy procedures in place which take the actor's mobility at the sake of security. A universal security property.
You don't include reputation and publicity benefits into the overall profit formula. If you sell stuff on grey market, you'll have to keep your lips tight over that deal. It isn't going to your resume, so if one day you'll decide to join a security division in some corp, you'll have nothing to show them. Whereas a public achievement like this may be a door opener for many places. Same thing with things like pwn2own or security conferences. Why burn knowledge there? Because it promotes you.
Shameless plug: I have created https://infosec.pub/c/exploitdev, a community inspired by /r/netsec, /r/vrd and /r/ReverseEngineering (no relation to any of these and I am not the admin of infosec.pub either) dedicated to technical security research content. The instance also has other infosec-related communities which I hope will get traction as well.