This depends on intent. I don't want to confound exploration with activism, but there are many instances where damaging a company may be the ethical thing to do

This depends on intent. I don't want to confound exploration with activism, but there are many instances where damaging a company may be the ethical thing to do. In the long run, avoiding damage is in the hacker's continued interest to be able to maintain a 'beachhead' through stealth; but where privacy and 'fairness' are concerned, avoiding damage isn't always desirable.