There are companies who buy vulnerabilities/exploits and sell them to the highest, supposedly non-criminal - to whatever extent that can be applied to governments, law enforcement and intelligence agencies - bidder. That's mostly what I had in mind and black market is a misleading term for it, but I can't edit the comment now.
See also tptacek's comments in this thread.
Wouldn't the investigation lead to him? He noted he did not know, at the time, that it was an RCE. So he would need to research further (where he might trigger an alarm). He also noted he utilized staging environment, which he had access to due to previous found vulnerabilities (so Google had his personal details).
So, now imagine he found something and he had sold it. If it was used, Google would do a thorough investigation to find if given vulnerability was abused in the past. And they find this guy using it exploratory and nothing else. It's not hard to put 1+1 together after that.
While the idea of finding an exploit and selling it for hundreds of thousands of dollars on black market sounds exciting, it wouldn't be so easy in this case.