They mostly find it useful when there is no other chance like social engineering the admin side of the determinated website or most of them go search by the 0day exploits where they can decide to use them or resell them even.