Just as a security researcher’s job is to find vulnerabilities and promote best practices, it’s not to hack and then publicly shame their employer. Ethics researchers should be the same, no? Find ethical issues and promote best practices, embarrassing your employer seems counterproductive except perhaps as a last resort.