> You can legally hack and wiretap your own phone, and build tools to do that. It's also legal to sell those tools.
Just because you have a right to do something to your own device doesn't mean you have a right to sell it. It is not a huge stretch of the imagination to see 0-days being classified as munitions and encumbered by ITAR. I've seen open source drone guidance software taken down for similar reservations, and that was far from a weaponized instance.