Because a vulnerability in FB's legal admin panel (and most other vulnerabilities) doesn't interest said state actors?

Anything mildly "interesting" being sold through such a program would be high treason. How do you know this "Russian website" isn't actually a CIA honeypot? Or maybe it's not a honeypot, but instead of paying you 250K you just die of heart attack in a couple of months? Or they sell your identity back to your govt. as part of some unrelated game.

Bad business.

Advertise on RT, or something like that mostly public.

Honeypots, I guess? At least that's what I'd set up if I were CIA/NSA. Ask Facebook to create a bunch of vulns that leave the intruder in a sandbox, sell the vulns, and watch where the attacks come from.

Many do. On Darknet Diaries Podcast they mentioned even the NSA buys zero days, and selling to them (if you're a US citizen) won't be (as?) illegal as selling to a foreign nation is.

That's called selling on the dark web, and it's at least vaguely mercenary, IMO