Propably untrue, the only way to know is to do threat intelligence, and inflitrate those telegram groups where these brokers operate, I doubt the writer of the article did that. Maybe he conflated any vulnerability with a 0-day one?

...or was just looking for a clickbait title.

Surely someone once offered a vulnerability for 500k somewhere, but that doesn't mean someone bought it.