I understand the reward, but Facebook was buying the incentive for people to look for bugs like this; they weren't competing with the black market.

I'm guessing not much? I was under the impression that nothing you delete on Facebook is ever truly deleted, just marked as disabled and hidden. And if they're logging their API calls it should be fairly straightforward to look up which albums were disabled using that one token and switch the flag back.

Half-life means what it usually does: time until 50% of the thing (vulnerable clients) have evaporated. You can plot out a decay curve. Vulnerabilities are valuable when many clients still exist which can be profitably exploited.

The half-life of this bug is ~0. As soon as Facebook becomes aware of it, it is nearly instantly fixed everywhere. This is very not the case if you get e.g. code execution on a version of Java which will take 50 months to completely disappear from the wild.