This is hardly worth mentioning when talking about 0day markets, but what stops a state willing to pay $500K for an exploit from taking the hacker(s) back home?

This is hardly worth mentioning when talking about 0day markets, but what stops a state willing to pay $500K for an exploit from taking the hacker(s) back home? Is it ethics?