Google and iVerify researchers say the case points to a thriving secondary market for high-end zero-day exploits.