Security researchers consider buying undetected software security vulnerabilities from a notorious group of hackers.