Most hackers are responsible. Hackerone is a site where anyone can sign up and start claiming bug bounties for reporting vulnerabilities. They claim to have 2 million active hackers. Just like anything else, the people breaking the law are in the minority and probably resorted to it after trying to make money the legal way.