I'm not sure but if negligence is punishable too for facilitation, it should stick, right? I think it's reasonable to expect that most buyers of exploits try to use them in illegal ways (or are feds acting like that to catch you).

They won't have to get you for facilitating the later crime, they can get you for testing the exploit on your own account, which is also a crime since OpenAI's computer system is involved.