I would rather people who find this kind of stuff pad their resumes and get coolness points on HN than sell this exploit on the black market. But your priorities may be different and you might prefer they do the latter.

This is just a false dichotomy. Sure researches want money, credit but not at the cost of harming users or doing illegal things.