There are probably few such criminals reading your comment now :)

There are sensible reasons not to report vulns, like utter incompetence of the system's owners or the system's security standing in the way of your perfectly legal activities.