The problem is that they do not sell vulnerabilities. They sell weaponized exploits. This is not the Zero Day Initiative.

Imagine if someone researched and sold exploits to anyone (“terrorists”, foreign governments, etc.) internationally which allowed illegal access to say, real-world bank vaults, nuclear military technology, or high security prisons. Theoretically, your same logic would be valid, but I'm fairly sure selling that kind of information on any one of those would be illegal. If not, than it should be!

It's an exaggerated example, but it seems to me that sometimes what is in the best interest of everyone as a whole outweighs the desire of some individuals to exploit the weaknesses of others for personal gain.