Selling exploits doesn't inherently violate the CFAA.