That's exactly what thegrugq does too. Tomorrow if I find an iOS bug that's exploitable I don't have a rolodex of contacts to sell it to hence the need for this service. As a middle man he can confirm the bug hasn't already been discovered and is generally trusted not to keep a copy himself and hack the planet with it after sale. This arrangement protects the seller too from revealing their exploit code to the buyer before payment. Anybody could create a Tor market for auctioned exploits but somebody has to verify the goods first or you get swamped with junk offers.

It's also similar to patent trolls in that the people doing it breath oxygen and have skin.

In the case of patent trolls, they're leveraging asymmetries in the legal system and flaws in intellectual property laws to profit from non-meritorious lawsuits.

To the extent that a market in zero-day vulnerabilities is something you want to have (I'm not sure where I stand on this, exactly), a firm with a reputation to maintain does have a role to play. They sell the exploit to Mitnick, who has an idea of which ones he'll be able to sell, and the companies buying them are able to avoid the transaction costs and risks associated with buying and then testing potential zero-day vulnerabilities submitted by arbitrary hackers and counterparties. He's playing a valuable role by mitigating risk for both the companies he approaches and the random hackers. Consider also that it's hit-or-miss when you try to contact a company about zero-day vulnerabilities whether or not they are going to pay you, ignore you or, worse, sue you. Knowing Mitnick doesn't sue people who submit bugs to him, and presumably he has lawyers vetting this operation carefully, is a significant benefit for bug-finders.