Reputational and security liability is highly debatable. Legal is highly jurisdiction dependant.

They often act as marketing and can find and report security vulnerabilities rather than the criminal element doing so first.