MIT’s Lincoln Laboratory for example was originally opposed by the university president at the time with huge community backlash against the university becoming connected to a military research lab.
Part of the original charter of the lab was that its scope of operation was very, very strictly restricted to US air defense, and very strictly not the development of offensive capabilities. There was even a huge report commissioned by the university to detail exactly the defense needs and set boundaries around them in terms of what projects could possibly be approved for funding at the lab. The “no attack” component of this was a giant, first-order constraint of the whole multi-million dollar endeavor to even create the facility at all.
On the other hand, I do agree many other cases could be like what you suggested. Just saying not all.. and some of them would be directly, loudly predicated on “defense only” mandates where it would be a huge surprise if the research was subverted later.
For example, many defense research labs have “red team” projects where new capabilities are developed strictly to understand adversary capabilities, feasibility / cost to extend a legacy system with modern tech, and many similar things. Kind of like Myth Busters but applied to questions about an adversary’s capabilities.
Some of these research labs are even joined with academic institutions that carry with them a strict ethics mandate that any and all such work can only be theoretical or defensive in nature, to assess and defend against threats, anticipate new threats or debunk claimed capabilities from existing adversaries, but absolutely never to carry out an offensive agenda, enhance existing attack capability or anything similar.
In a situation like that, you absolutely could be greatly surprised & upset to learn your defensive “myth busters” research is turned around and repurposed by another team or something to enhance attack capabilities.
It could be similar with computer security as well. Imagine putting your best effort into developing an attack, exploit or malware because you think it’s purely to determine if something could be done by an adversary, or to highlight a weakness purely for defensive purposes... only to find that it’s used to directly attack someone else after the research leaves your hands.