I don't think so, businesses like Zerodium bought zero days in plain sight and I don't think they faced legal consequences. They don't operate anymore though. So basically I'd say it depends who you sell it to and how.

It's my understanding that those groups buying exploits in plain view sold exclusively to government agencies which is why their business model was tolerated.

Facilitation of a crime is a crime too. So I think in the US and most western countries, yes. At least if it gets used illegally later.

Pretty sure you need actual knowledge of a planned crime for that to stick. But I'm also sure the defense will be expensive.

They won't have to get you for facilitating the later crime, they can get you for testing the exploit on your own account, which is also a crime since OpenAI's computer system is involved.

I'm not sure but if negligence is punishable too for facilitation, it should stick, right? I think it's reasonable to expect that most buyers of exploits try to use them in illegal ways (or are feds acting like that to catch you).