I haven't made a single statement about their intent.

I have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.