Earlier quoted context omitted.
1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal. The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.
Thats why many doing that kind of stuff probably use a third party that keep money for a definite amount of time.