In the general case, yes, but there are specific cases --- and they are probably more common than you'd be comfortable with --- in which the answer is probably "no". It's legally very dangerous to sell a vulnerability to someone who is going to use it to break the law.