This guy has three options: 1) short 2) go long 3) do nothing. Given he knows about this vulnerability, what is the "ethical" thing to do. But the stock? Don't engage?

I think, in fact, he has a duty to short the stock.