Only stealing from people who haven't asked you nicely to stop doesn't scream "highly ethical" to me

Security researchers put a lot of emphasis on responsibly disclosing vulnerabilities. The maintainers of this project could have easily done the same, but they didn't