You could easily argue they are doing the opposite, in that they close down potential weapons and responsibly disclose them so that they are fixed and patched. Add to that, a majority of computer security work is revolved around improving infosec. A further point, I doubt infosec researchers are the types that run a deprecated microsoft web browser.