This answer only touches on the process of selling 0days to resellers like Zerodium and is only guesswork.
From the Zerodium FAQ:
What happens after accepting an acquisition offer from ZERODIUM?
After evaluating and approving the research, ZERODIUM will send you the final acquisition offer and the agreement to sign.
By signing the agreement, you will accept to sell your research to ZERODIUM and transfer all related intellectual property rights to us, meaning that the research becomes the exclusive property of ZERODIUM and you are not allowed to re-sell, share, or report the research to any other person or entity.
You can take a look at the submission process of Zerodium in this chart.
The part I marked in italics in the text is the important one. You as a researcher have to make sure that you document your research in advance and may1 then claim intellectual property for it. That is pretty easy and cheap for instance in the US (costs 35$ I think).
Zerodium is then not allowed to reuse your code, unless you transfer the intellectual property to them. It will however - as you already pointed out - be pretty hard to prove that Zerodium will not do that. That is because Zerodium and their buyers do everything to disguise any business dealings they have. Possibly a contract is signed after Zerodium claims its interest in an exploit and before a researcher sends a pre-offer, but that is only speculation on my side.
In conclusion: A lot of that transaction - as every transaction with a 0day broker anywhere else - will rely on trust. If you don't trust them in the first place2 don't sell to them. But: If you have a working exploit, my guess is they won't fool you. Because someone who is capable of developing one working exploit - the product Zerodium is trying to sell - is probably capable of developing more. So from Zerodium's perspective it is economically smart to establish a relationship and therefore trust to this person.
1 I'm not 100% sure on this, but I think you still have the Intellectual Property on your creation, even if it is not registered. Quote from the linked PDF: "With
unregistered IP, you automatically have legal rights over your creation. Unregistered forms of IP include copyright, unregistered design rights, common law trade marks and database rights protection for confidential information and trade secrets"
2 IMHO: you shouldn't, just for ethical reasons