But you aren't choosing between a perfect world, where bugs get reported only to the vendors and the vendors promptly fix them, and an open market. Right now, governments and shady corporations are already buying. If it costs some company $250k or $1M to buy their vulnerability, maybe they'll work harder in the future. Or hire their own pen testers. And they'll have the money, because almost by definition attractive vulnerabilities are those in widely used software.

In the complaints about auctioning off vulnerabilities it's hard to avoid hearing companies bitching that they may have to pay security researchers, and it will be harder to intimidate them with law enforcement.