Sure, but there's no incentive to hold anything back.
Let's say you break into a server and steal 10 vulnerabilities, from an organization (e.g. the NSA) who are never going to acknowledge how many vulnerabilities they had or were stolen.
If you want to get the most in the auction, the best thing you could possibly do is to release all 10 of your vulnerabilities for free, claiming that it's just a teaser, and that you have many more. Then you take in bids and disappear. It makes no sense to only release 2 or 3 and hold back the remainder; the unreleased ones are essentially wasted because they didn't actually contribute to any bidding activity: nobody knew they existed when they were bidding. That they exist at all is a happy surprise to the winning bidder, but with no further sales, customer goodwill isn't worth anything.
There's really no incentive to actually follow through on the sale at all. The only purpose of the "goods" to the seller is to attract bids, but with nobody to verify what's actually for sale, the best strategy is to use everything for what amounts to advertising, in the hope of gaining more attention and attracting more bids.
I wouldn't dump it all at once, if I were them, though. I'd do an initial release, and them some more once the initial bids (if there are any) slow down, and keep doing that over and over until the market is entirely worn out and all the vulnerabilities have been disclosed. That's the profit-maximizing strategy, I think.