Earlier quoted context omitted.
Why don't state actors that are explicitly aligned against the USA have public bug buying programs? Like a Russian website where you can go and submit your bug and get $250K.
Because a vulnerability in FB's legal admin panel (and most other vulnerabilities) doesn't interest said state actors? Anything mildly "interesting" being sold through such a program would be high treason. How do you know this "Russian website" isn't actually a CIA honeypot? Or maybe it's not a honeypot, but instead of paying you 250K you just die of heart attack in a couple of months? Or they sell your identity back…
Advertise on RT, or something like that mostly public.