There are exploit brokers. The biggest public one I know of is https://zerodium.com/ .

Before zerodium existed I think it was a bit more personal. Here's an article about the Grugq acting as a broker.

https://www.forbes.com/sites/andygreenberg/2012/03/21/meet-t...