>In other words: criminals.

You're not required to disclose bugs, nor is developing exploits a criminal offense (assuming no intent/conspiracy to hack stuff).