But whether someone knows there are vulnerabilities is not the same as exploiting the vulnerabilities for nefarious uses.<p>Lets say the FBI did not exist.  We know those same vulnerabilities would exist, except an organization would not be aware of them as such since the org does not exist, but the vulns would still be there and software would still be as vulnerable.  So them knowing is more or less neutral in terms of making software more or less vulnerable.