I've seen one these "lone wolf" actor preemptively collecting emails of a very high profile target via sophisticated penatration (APT? LOL), then sold these data to a state-owned enterprise. In exchange his hacking violations were cleared.

The government simply kept a loose end to these kind of foreign hacks. For domestic offense, the rules are very strict. Some dude famously posted some kind of minor XSS vulnerability of a random PLA veteran management site, then the hole public disclosure site was shutdown by the government and site admin was jailed. LMAO. So today the Chinese underground market was more active than ever before, because there are no more free bugs.

Everything you just said--if legitimate and if identified via IC-contracted *INT--would with near-certainty be classified and appropriately compartmentalized. If it's research from an outside institution, it'd be more interesting to read it.