As a rule, no. Because they are building upon another product, I see no reason why they ought to be allowed to sell their work without going through the proper channels for permissions and whatnot. Should the product owner allow them to sell their work, the product owner ought to at least ensure there is some measure of quality standard (That the product even works for example) as this at least provides some measure of quality control.