Indeed. I think I covered that in "criminal" category, but perhaps I should have been more explicit.
Sanctions on selling exploits seems easier to achieve though since there is less of a conflict with economic interests
