It's a bit of a stretch to cast those as "legitimate use". A security vulnerability is a security vulnerability, regardless of who exploits it.