There is a thriving “grey” market for vulnerabilities, where brokers buy vulns and sell them on to e.g. intelligence agencies. This is well established and unlikely to cause much legal difficulty for the bug finder.