No more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-mali

No more so than finding security vulnerabilities. Captchas that are trivial to break are going to be broken no matter what, so it's better for someone non-malicious to break it and make it well known, so that people don't use the captcha, than for it to go unnoticed.