It’s probably a lot less time consuming and risky than “going to market”. Reminds me of a panel at DEFCON this year that dealt with the fact this stuff is increasingly covered under export restrictions and a lot of the ecosystem is trust based.

Some probably don’t have connections they trust to sell to, and buyers mightn’t trust the sellers to not re-sell their exploits

"The market" is highly unethical and anyone who sells exploits there is undoubtedly a black hat.