"One could argue that their process was similar, in principle, to that of white-hat hacking: play around with software, find bugs, let the developers know."

No. Just no. You cannot argue that introducing vulnerabilities in one of the most critical piece of open-source software as a test to see if it will get through is "white hat". Had they talked with Greg beforehand, maybe, but as the situation stands right now this is grey hat at best.

Whether you think this research was okay of not, even a very liberal definition of white hat simply isn't compatible with what they did.