Big difference between writing a report on a vulnerability and writing malware that exploits it.