The most successful ones work for the feds while squirreling away the proceeds. The feds don't mind cultivating crime if it's increasing their numbers.
Actually, criminal copyright infringement is a $250k fine, 5 year felony, in the US. Pretty amazing. You are vastly more likely to be prosecuted criminally if you're part of a group, and especially if you focus on 0-days. Even more likely if you sell things, charge for advertising on your site, etc.
DMCA still makes some 0-day exploit research not totally safe, either. https://www.eff.org/wp/unintended-consequences-under-dmca I don't know if anyone has been successfully convicted, but a lot of prosecutions have come up, and that's enough to deter many people.
But, I think the OP is right. The only successful (for lack of a better word) black hat is going to be a loner.