This sounds really risky for both the buyer and the seller. For the buyer, the seller may be able to recover the account (and withdraw any crypto the buyer has in it). For the seller, it will look to the exchange as if it has never been sold, so if the buyer does anything suspicious (like launder ransomware payments) the police may get the account sellers information from the exchange and come knocking on their door.