Lets look at this another way: If a security researcher notified you about a security flaw that was trivial to exploit, including showing you how to reproduce i

Lets look at this another way: If a security researcher notified you about a security flaw that was trivial to exploit, including showing you how to reproduce it, would you tut-tut them about computer crime? Here's another question: You, by design, are going after somebody publicly notifying you, but by design you aren't going after those who actually exploit the flaw. What incentive is there to notify you of a flaw at all?