How do you know? You could explain the impact of the vulnerability and let buyers on the black market decide and bid whether they could do something useful with it.

That's not how the "black market" works. There isn't like some bazaar where people describe vulnerabilities and people bid on them. Only a very specific subset of vulnerabilities, those that slot into existing business practices and CNE stacks, have buyers.