Because a vulnerability in FB's legal admin panel (and most other vulnerabilities) doesn't interest said state actors?

Anything mildly "interesting" being sold through such a program would be high treason. How do you know this "Russian website" isn't actually a CIA honeypot? Or maybe it's not a honeypot, but instead of paying you 250K you just die of heart attack in a couple of months? Or they sell your identity back to your govt. as part of some unrelated game.

Bad business.