> Would the security researcher be held in any way accountable for activating the ransomware?

I think that would be the equivalent of an arsonist also leaving a water activated chemical at the scene of the fire, and then blaming the firemen for using water to put out the fire when it made the situation worse.