This situation seems colored by the specifics of the case. The questions of morality and ethics wouldn't be involved were the company in question, say, a cybers

This situation seems colored by the specifics of the case. The questions of morality and ethics wouldn't be involved were the company in question, say, a cybersecurity firm. In that case, it might seem perfectly reasonable to use this type knowledge advantage as a means to beat the market, especially if the firm were unwilling to pay directly for the information. The origin of this sort of behavior, it seems to me, is a lack of understanding on the part of firms. If St. Jude's appreciated the market value of securing its devices, it would surely pay for the exploit. However, there's an inefficiency in the market and this prompts "hackers" to seek alternative means to profit from the work and research that they've done. I personally would not engage in this type of exploitation, but these situations will lead companies to place more value on security of IOT and other connected devices than they currently do.