None of us are thinking of any of this before the brokers already have; this work has been going on for many, many years. You can resell vulnerabilities, but the contract terms you get from brokers are tranched, and they stop paying when the vulnerability is burned. Your incentive not to spread your bug around is that you you're cutting your nose off to spite your face, not to mention that you're probably making the terms you'll get for future bugs worse.