It's only a fine line if you think everything they find would remain unfound without them.

It's sort of like saying Consumer Reports walks a fine line if they alert the public about any dangerous behavior they see in the products they test. The danger is always there, telling people about it so they can avoid it and it can be fixed is to the public's benefit.

I don't think Consumer Reports rates other product review sites with which it directly competes. Project Zero is more like politicians paying for opposition research. You can argue that it benefits the public to have dirty deeds exposed by any means necessary, but it's hard to call it altruistic.

That's one way to look at it. Another way s that they are subsidizing the security team of their competitors.

Also, project zero gives 90 days or until you've released a fix[1]. If you can't roll out a fix for your problem in 90 days, you're either playing fast and loose with your customer's security, or you've lost the talent to competently fix the problem, or you've made such a poor choice in your design that makes it hard to fix that nobody should use your program or service anyway.

Any company or project unwilling or unable to roll out a security fix within 90 days doesn't deserve your support or money.

1: https://googleprojectzero.blogspot.com/2015/02/feedback-and-...