This video addresses that:
All certificates are cryptographically linked to an identity-anchor certificate, meaning buying a certificate would require the seller reveal the private key tied to the identity-anchor certificate, a tall order I would argue.
In the case of stolen identity certificates, they can be revoked thus making their illegitimate utility limited.