That's why brokerages like Zerodium exist - you can sell it to them, and they'll sell it onto state actors.

Probably you're just used to a relatively good life, not a bad thing :)

Image being able to sell this off for $20,000 (although I think you could ask for more, seems to be a really bad vulnerability) in a marketplace, for >90% of the world that's a pretty good amount of money that you could survive a long time on or add a lot of additional quality to your life.

Am I wrong in thinking that with this vuln you could drain any financial accounts that they log into Arc with? Or, if they use Arc at work, that you now have a way to exfiltrate whatever data you want?

A browser vuln is about as bad as an OS vuln considering how much we use browsers for.