I don't think so, businesses like Zerodium bought zero days in plain sight and I don't think they faced legal consequences. They don't operate anymore though. So basically I'd say it depends who you sell it to and how.
It's my understanding that those groups buying exploits in plain view sold exclusively to government agencies which is why their business model was tolerated.