A new user is much more likely to scan the codebase and report vulnerabilities so they can be fixed than illegally exploit them since most people aren't criminals

Exactly. Who even hacks stuff? Most people will report the issue to earn xp and level up than actually exploit it.