There is also the fact that anyone in the industry can make a few phone calls and have a bidding war on this type of exploit that will go well into the 6 figures, possibly as high as 7 according to some. $1M sounds high to me personally, but there is no doubt that it will fetch a few hundred thousand.
To my knowledge, the US government is the biggest buyer of unpublished exploits. And they pay a lot more than 60k. One well-known US-based company is even run by a former NSA employee, and they're currently advertising a remote pre-authentication exploit in the latest version of MySQL.
It is also worth noting that breaking into the computer of a foreign national that is located overseas is often not a crime in the united states, or is at least considered very difficult to prosecute if it doesn't involve fraud, financial transfers or a few other hot buttons.
This isn't new, security companies have been paying contractors for unpublished advisories and exploits for over 15 years now.
Selling exploits on the black/grey market is and will always be fast money, and a bad idea.
Pwnium is just there to lower those prices, at least attempt to.
This one exploit is there to be able to say "see, we get those for 60K, why would we pay you 500K"?