It should be considered a universal law of corporate behavior: any information that has theoretical value will eventually be sold.

Even if current management has no intention of exploiting it, they’ll be replaced by the board, or the division and its data will be spun off and sold for its IP—that’s just corporate nature (i.e., the purpose of a system is what it does).

So a chess player that exploits an opponent’s weakness is hacking?
A snake that finds an entrance to a gopher burrow is hacking?

“Finding vulnerabilities” is the kind of dangerously overbroad generalization that gave us the DMCA.