I know one guy, he makes a living like this, studies the code from all sides and looks for exploit in smart contracts, sometimes sells them to the team, sometimes uses them himself, in the last few months he has a lot of work. I think that such cases are not uncommon.