I mean — the best cybersecurity experts are often former black- or gray-hat hackers.

Hiring people with intimate knowledge of Bad Thing to try to fix Bad Thing is not necessarily a bad strategy.

Just need them to have very legible incentives. That’s less clear to me in this case.