The difference is that the security is objectively verifiable - either they were able to compromise data/access/..., or not. Despite the different incentives fo

The difference is that the security is objectively verifiable - either they were able to compromise data/access/..., or not. Despite the different incentives for the company and the hackers, if you can't break in, you cannot just fabricate a vulnerability because your paycheck depends on it. Whereas "ethics" is a subjective field, so you can invent arbitrary "ethics violations", and you would - precisely because your paycheck depends on it. This is not new, see also bioethics - at best it's completely useless, at worst it's basically self-sabotage and your competitors would be happy to see you engage in it.