Even though the ERC20 you own is not listed yet on any exchange there are possibilities that the coin's project is under development and needed some time to be on exchange and this guy wants to get as many ERC20 for a low price but I see a different thing here.

What I see:
1. This guy knew that some ERC20 that are not yet listed has some potential that the user didn't know and will take advantage to them.
2. This guy might run your ERC20 (This user clearly indicates that he/she will pay after you send the ERC20 token)
3. He will might run as many ERC20 as possible for a bigger chance to get a potential ERC20 to other users.

Solution:
1. Use ESCROW
2. Post all transactions here to be transparent.

I'm not sure if this user is legit or not but this is what I see in my own perspective and so to be sure use a reputable escrow.