If each of the 1 million bugs can only be used to exploit 1 system, the transition is from "1000 exploitable bugs per system" to "1 exploitable bug per system".

You might say that's a big "if", but you did say "1 special bug"...

The cost of finding an exploit has gone way down, but if you can only amortize that cost over a single use, then the ROI probably won't be there for a lot of them.