"John Binns, a 21-year-old American who moved to Turkey a few years ago"
I'm assuming it is the Turkey thing, probably counting on that to be a significant barrier. Yes they have extradition but I've also heard that Turkish authorities are quite amenable to bribes as well.
Turkey is also a NATO member. If T-Mobile can get the U.S. government to plead their case, that could generate serious impetus for action from the top.
Also, if you're in a country whose officials take bribes, advertising that you're (a) vulnerable and (b) potentially in possession of cash is dangerous.
If the dude is banking on this, the major issue is that the Turkish authorities may be quite amenable to bribes from anyone indeed. Subsequently, my wager is that both TMobile and many among the 50M whose details were stolen have far deeper pockets than hacker exhibit A.
In other words, the dude must be absolutely certain that government corruption can only go well for him. In the US, he'd "only" go to prison if the system wants to make an example out of him. In a place where anyone can be bribed to do anything, the sky is the limit.
Unless he gets a cushy gov't cybersec job from all this, which is another angle I have just considered.
Second, if the dude manages to make any appreciable sum out of selling the data, the corrupt officials may come by with the proverbial $5 wrench and encourage him to share the spoils for continued protection and avoidance of wrench induced bruising.