I disagree with (a). Activities can be deemed ethical or unethical, and those norms are presumably reflected in our laws (as unauthorized hacking is). When they're not constrained by law (as certain publication and experimentation practices aren't), then they are constrained by social convention.
This is one of those cases, like "Zero Trust Networking" where you can't derive the meaning of a term axiomatically from the individual words. There is "responsible" and "irresponsible" disclosure, too, but "responsible disclosure" is also a specific, Orwellian basket of vendor-friendly policies that have little to do with ethics or responsibility.
"Responsible" and "irresponsible" are slippier words in the disclosure context. In the civil legal context, "responsibility" implies blameworthiness and liability arising out of a duty of care and a breach of the duty. But in the vulnerability disclosure context, since there's no duty prescribed by law, it has come to mean "social" vs. "antisocial" - getting along vs. being at odds.
My point is that it doesn't matter how slippery the underlying words are, because you're not meant to piece together the meaning of the statement from those words --- or rather, you are, but deceptively, by attributing them to the policy preferences of the people who coined the term.
Logomachy aside: "ethical hacking" was a term invented by huge companies in the 1990s to co-opt security research, which was at the time largely driven by small independent firms. You didn't want to engage just anybody, the logic went, because lots of those people were secretly criminals. No, you wanted an "ethical hacker" (later: a certified ethical hacker), who you could trust not to commit crimes while working for you.
I guess what I'm trying to say is that there is, and can be, such a thing as "ethical hacking," but perhaps it's not coterminous what vendors and others might claim it to be. The meanings of words evolve over time, sometimes for the worse (cough "literally"), and sometimes for the better. Groups have also reclaimed derogatory words through concerted action.
It's a complicated human activity, so of course there are ethics to it. But I'd strongly recommend not using the words "ethical hacker" next to each other, because that term has more meaning than you probably intend.
