The good news about nukes: they have a shelf life – most soviet-era nukes needed to be replaced every 12 years, as the loss of fissile material to natural radioactive decay would render them dirty bombs after a certain point. Now don’t get me wrong, a dirty bomb still sucks, but it’s no nuke.
So when a collapsing Russia is hypothetically selling nukes, they’re probably selling old depleted nukes or nearly expired nukes. To a terrorist it is almost the same thing, but to nation stations looking at MAD, it really isn’t.
Did you take physics in high school (or elsewhere) and learn about half lives? Many of the main ingredients in nuclear weapons all have half lives: tritium, plutonium, etc – and most have fairly short half lives. They need to be continuously produced, enriched, refined, etc. to keep the purity high enough to be detonated. Some of them require breeder reactors and other fun thing.
Well, okay, U235 has a half-life of 700 million years, but you still need to enrich uranium to increase to proportions of U235, since U238 cannot sustain a chain reaction.
The original nuclear weapons were U235 weapons. Later bombs added all the harder to make stuff to make them bigger – fusion bombs still usually have a U235 starter to get the reaction going, but rely on things like tritium and plutonium to do the fusion bits. Even the Lithium-6 (which is stable) slowly decays to helium and tritium inside the weapon as neutrons from the other components hit it.
Anyway, enjoy the Wikipedia rabbit hole.