I'm not sure but if negligence is punishable too for facilitation, it should stick, right? I think it's reasonable to expect that most buyers of exploits try to use them in illegal ways (or are feds acting like that to catch you).