I'll comment exactly on your example.
cPanel, it's a well known, respected control panel for servers that's being used by many web hosts over the years, their profit is their reputation, if they didn't fix it as fast as possible they wouldn't be in this place.
If someone finds an exploit, they should report it to the "script maker", why would a developer ignore an exploit report? specially one that built a name over the years.
I do agree with you in a way, but the movement's point is that no one should exploit an exploitable -page-, basically, as I understand, they want the whole "sky is blue, life is good, everyone helps" package, to get rid of the bad apples, which in theory, is very good but impossible to do.
As you can see, it's because of those people that release exploits publicly, a lot of websites are being hacked every single day by hackers that barely know the concept or the basic structure of developing, I'm sure if you search WJunction you'll find at least 4 "hacked" threads within the last month only.
Exploits should be reported to the developer, if the developer ignored for any reason, then report it to the people you know using that script so they can maybe create a patch.
Releasing a "patch for an exploit" is much better than a "here is how to exploit this", don't just mention the hole, mention how to fix it.