Nightmare-Eclipse dropped six Windows zero-days and got called a criminal. The real story is a $17M bounty program against $245B in revenue, a six-year patch regression, a deleted MSRC account, and a disclosure ecosystem running on researcher goodwill that's almost gone.