> but it seems like anyone can publish an exploit on the internet without being a crime

Of course. The mere publishing of the exploit is not the criminal part. Its the manner & intent in which it was published that is the problem.

> At this point, we have no confirmed access via compromise.

While i don't know the specifics for this particular law, generally it doesn't matter what you actually did. What is relavent is what you tried to do. Lack of success doesn't make you innocent.

> Who would have standing to bring this case?

The state obviously. This is a criminal matter not a civil one. You don't even need the victim's consent to bring a case.

[IANAL]