Honestly, when people say things like "Consequently, there is no real legal difference between a feature and an exploit" (source) I cringe. Is authorship not a legal difference? The exploit was not created by the entity that provided the feature. The vulnerability that the exploit uses was, but the exploit itself comes from an adversary. It seems to me that should count for something.