Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.

Most people don't want to be felons.

I'm sure there are places that would sue you for that, and it's not worth the bother. Bug bounties really compete mostly with people like me who would say, "Haha, I found an issue with Meta; they're gigantic idiots." And then make an X post or anything about it.