Okay, then first download all their sources (perhaps with model weights?) and sell that. Not the bug itself

Now you're not selling a vulnerability, you're planning a heist. That is a thing you can do!