Selling exploits to broker, then reporting to developer?

What stops a security researcher from selling a newly discovered exploit to a company such as Zerodium, receiving their payout, then reporting the vulnerability to the developer?

As I understand, companies such as Zerodium have high anonymity for their submissions (payouts in crypto, etc.), so I can't really see how they can deal with this by, for example, banning submissions from particular users?

In fact, what incentive is there for a security researcher not to do this? Seeing as reporting …

cybersecurity developer exploits reporting selling