Really your arguments make no sense. First security flaws are not secrets. If I put a number in a box in my house and you break in and take it, that is 'stealing' a secret (aka credit card number). But if I make a million boxes with the same number in it and sell them there is no expectation that you will not look inside the box.

Moreso selling "information that you would rather not be public but is not considered a secret legally" is completely legal in the US. There are lots of books published and sold containing information that some company or person would rather keep secret.

>Responsible disclosure is a thing.

Not a legal requirement. More of a gentleman's agreement after companies sent the law after security researchers so researchers sold or released anonymous zero days.