Blaming the security researcher is a bad idea. Without the security researcher, the tool would still be created and used by somebody. The security researcher highlights the problem and makes people understand the danger in it. Without the POC, is it highly likely people who know nothing about cyber security just wouldn't care about the vulnerability.

I’m not blaming them in a bad way. I’m just saying it’s not completely not their fault. Releasing vulnerabilities and POCs for major applications should be handled with utmost care and responsibility unless they don’t care about the consequences of their actions. There are tons of script kiddies using POCs out there who would never be smart enough to create them themselves. It helps abstract the actual hacker process down to just grabbing a git library and executing it on a victim.

How do you properly test that you mitigated a vulnerability if you don't have a POC? POC's are useful for other purposes than malicious attacks.