By taking the cash, I am sure you are bound by secrecy enforced by jail time. I see these increased payments as hush money to keep researchers quiet while they feed them to the NSA for zero day exploits.
By default a naturally occurring exploit probably upon inspection looks less intentional then one put there on purpose.
. . . except for the outsider who mailed them about it and got paid a chunk of money as a result.
At least an internal employee is on your payroll, and has been screened with a background check. You don't get to screen which people get to discover vulnerabilities.
They would not know about the program which takes that exploit and then gives it to the NSA.
Nevertheless, I don't see how this is a bad thing.