> there's little to gain by holding on to an exploit

Correct, but there's also very little to gain by developing it in the first place. Right now, the pinata's value is approximately $2500, or less than two straightforward XSS bugs on Google properties, which are waaaay easier to find. There's just not anywhere near the motivation required to get (mostly well-paid) security people on this. It's interesting, but that's about it.