Many countries have very broad cybercrime laws - like prohibitions on "gaining unauthorised access to a computer system". And in some countries, even when you're in the right going to court can be a costly and time-consuming endeavour.

I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.

But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.