Finding a fine line is probably what's required. Having your tool suffer DDoS from known exploit vectors harms all the legitimate users at the expense of some bot-writer's pleasure.

Arguably this is the basis of many laws that govern our lives. Lots of rules are in place and enforced because individuals found ways to ruin things for everyone else