I think there is a difference between identifying an exploit exists and making a tool that makes it easy for anyone to exploit. I think if you are releasing a tool to act on security vulnerabilities it should be done so very carefully so that it can't be easily used to commit crime.
They really shouldn't.
Neither should any other security researcher who publishes exploits.
Neither should any other developer of cryptographic technology.