Surely you're being speculative though. Who's to say they're the ones finding the exploits and not buying exploits themselves? There is no evidence of that, just of them selling the exploits, developing bots and selling bots. Using an exploit, being busted and then admitting that you were just testing security measures is literally written on the front of the Hacker: 'Get out of jail free card'. If you're going to associate with people who gain wealth from exploits, bots and gold then expect the situation we have right now.