Just to play devils advocate, they're selling exploits. You need not hack machines that do not belong to you to develop exploits.
Are they not in some sense selling knowledge? Since when is that illegal? (State secrets and whatnot aside).
I don't agree with it, but I'm just saying.