If it leads to a better outcome, does it matter that it's blackmail? It's the age old moral question of do the ends justify the means. Like most moral questions

If it leads to a better outcome, does it matter that it's blackmail? It's the age old moral question of do the ends justify the means. Like most moral questions the correct answer is not yes or no but "it depends." The real loser here would be the company with the retarded security policy, and they deserve what they get. If they have a bug bounty program, then naturally the ethical thing is to report the bug through the correct channels. If they don't then their users are the ones silently paying the price. If you wanted to be squeaky clean you could simply refuse to accept the highest bid if it wasn't from the company. In that case I really see no moral downside.