Okay, then first download all their sources (perhaps with model weights?) and sell that. Not the bug itself
Now you're not selling a vulnerability, you're planning a heist. That is a thing you can do!
Now you're not selling a vulnerability, you're planning a heist. That is a thing you can do!