Exploit construction is generally considered trivial vs. finding a vulnerability.

This is why responsible/coordinated disclosure exists in the first place.