It's not morally offensive to profit from the mistakes of a commercial entity. I'd guess that a large portions of companies are ultimately in this class.

And, really, dictators don't need help imprisoning dissidents -- it's sort of in the jobspec. It's not likely that a vuln would cause this to happen unless it was in systems created and secured specifically for sedition, in which case a researcher should be considerate of the potential damage.