i really don't understand the ethically complex part. off the top of my head i can divide these kind of decisions into 3 categories: offensive security which in most cases is clear on which side you are on, bugs that can affect user's wellbeing for which there must be guidelines or someone is not doing their job (technical incompetence is besides the point, everybody makes mistakes but some risks can be quantified beforehand and mitigatios be put in place), and intended functionality like fingerprinting which most of the times are pushed top down from the product manager's side, again, pretty well clear cut where the responsibility lies. the point is most of the time the 'coders' decide on the how part and less on the what, which is where the real disasters come from.