How does selling an exploit to criminals not pose a moral question?