As zero-day exploits against Windows continue, Microsoft has been paying hackers to disclose details of security flaws for years. So why haven’t the attacks stopped?