Finding bugs is hardly a crime, selling them even isn't.

Now exploiting them? Yes that's a crime.