I think this requires more context - where are they selling the vulnerabilities? If they are selling them to a third party like the ZDI, then no, of course it d

I think this requires more context - where are they selling the vulnerabilities? If they are selling them to a third party like the ZDI, then no, of course it doesn't affect their standing in the legitimate securiry industry. However, if you sell a vulnerability to a group that will explicitly use it for malicious purposes and this becomes very well known, you'll obviously become a polarizing figure and many doors will close on you. Not all, of course. Just a lot of high value ones. This is not to make a moral judgment - it's just a reality that a lot of organizations won't want to be associated with you if you're labeled as a blackhat. Of course, if you do that you'll find plenty of other high value doors suddenly open up.