Well, in the case of the Tor network its whole premise is that it's resilient to attack. So either it is or it isn't. If it's resilient but only as long as people treat it nicely, then it's not actually resilient. And anyone who can demonstrate that is doing a public service. It would be irresponsible to discover a flaw and not disclose it, or to continuously exploit it. But it's not irresponsible to look for the flaw in the first place.

In the case of GitHub, it's owned by a nearly trillion dollar corporation. Nobody is hurting some mom and pop business here.