Which was Vupen too before that. One company name is unimportant because multiple shady groups and individuals are out there buying and selling 0daya. This is definitely the case because state actors don't develop 100% them themselves and must get them from somewhere. It's a small but nonzero market of expediency.

I'm sure there are companies that have stepped up to fill the void. But the market for "I DDoSed your phone" doesn't really exist.

Except that's not true because rendering a target's device unusable temporarily and/or effectively permanently is a useful payload regardless of what you think.

A useful payload for whom? Point me to someone who is willing to pay for such a bug and I'll believe you. Zerodium's old payout scale didn't even list denial of service, and to my knowledge no other serious vendor does either. If I can list a bunch of people who don't care about this surely you can find one who does.

That's not how vulnerability markets work. The idea that a broker would pay $75,000 for a phone DOS is very funny.