Is it possible, yes. However, it is also likely that the person selling the headband could've done a different exploit that got them said item and turned around and resold it.
Vulnerabilities in systems can often pop up with new things. This is why computers and systems need patching. The frequency of bundles popping up in the shop and the fact they might have a little more coding than a singular item, could expose them more than a regular item just based on a greater chance. This 'greater chance' could be as little as a fraction of a percentage more.
However, errors and intervention will always be part of the site. That's the nature of technology, and not cause for alarm.
Boo!