My understanding is that the online forums for this work quite a bit on reputation (for sellers at least). I can imagine people that use these hacks remove themselves from the ecosystem when they get caught. I also imagine the selling of this hack, if it happened, was probably brokered as a unique sale where the seller would not resell the hack, similar to how I imagine a lot of high-end zero-day exploits are sold. This, of course, is where the seller reputation would come into play.