It can be both, security researchers don't get a free pass just because they are exposing a wrong.
Had someone died you might (in countries which have it) get corporate manslaughter on a company that ignored security warnings. You absolutely would on the researchers and the journalist for their reckless disregard for the lives of others.