I'm not sure you can, in practice, have a completely free and open market for vulnerabilities, since any information about the vulnerability released broadly is

I'm not sure you can, in practice, have a completely free and open market for vulnerabilities, since any information about the vulnerability released broadly is likely to shorten the path to others discovering the same vulnerability [1], devaluing it implicitly through partial disclosure. So there's an interest in the market being small and secret. For the seller to keep the price high and for the buyer to maintain exclusivity on the exploit. [1] As a case in point, I showed the headline of the email for the bash vulnerability to a coworker today on the commute and he instantly described in accurate detail how it probably works. Not that this was a particularly difficult case, but I think the principle holds.