Does it stand to reason that attempting with purpose to discover exploitable flaws in and of itself makes you a bad actor? ( we've sentenced minors, academics and "white hats" using this argument )

What if someone wrote software that had a legitimate use, but made use of an undisclosed flaw that is then sold to many consumers and reverse engineered, revealing the flaw to larger constituents? What if bad actors merely used a tool out of its original context to exploit a side effect? Does this constitute intent? ( this was tried and the individual in question was jailed )

If an open source project collects money from a bad actor unknowingly and then discloses through a PR or official release the existence of a flaw previously unknown, should they be culpable? ( waiting to see this one play out, hasn't yet, but I have no doubt it will. Was kind of expecting it as a result event-stream.js )

This all just speaks to the concept of subjectivity vs objectivity in the litigation of this concept. The point where it is subjective, rather than objective is the point where it becomes an ethical discussion, and is therefor subject to the principle of fallibility and the human uncertainty principle. tl;dr, if you can't strip motive, investment and bias from the argument, it can't be objective by definition.