Of course, if it has a bad ESN it's probably been stolen. Legally that means you'd need to turn it into the police (at least in the US), ethically it means you should probably check WHY the ESN is bad, and practically you should worry about your credit card information, address, any personal details you give the fence, what malware is on the phone, etc...
Obviously it's your choice, but bad ESN phones and the people who sell them are way too shady for my taste.
Edit: There are two other ways I know of to have a bad ESN, a phone that was claimed as lost to insurance will have a bad ESN, this is insurance fraud and, while it *may* not count as stolen you should certainly check on the legal implications. Or the person may be a deadbeat and owe Verizon enough money they cut off his service. In that case it is more of an ethical question (this guy stole a few grand from all of us), he may be trying to make ends meet or he may be gaming the system. Safe money it there's something seriously wrong with the guy selling the phone given the number of them out there.