> I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"),

> I'm aware of [one case] where the developer of exploit code was found criminally liable You're probably referring to Stephen Watt (a.k.a. "Unix Terrorist"), who wrote the POS sniffer. His friend, Albert Gonzalez, then used it to steal 170 million credit cards from TJ Maxx and other vendors back in 2006-2007.