I thought it was more of a moral label than anything else. One who find vulnerabilities but doesn't exploit them or doesn't do it with a malicious purpose vs. the ones that do it with malice, Of course you can't read someone's mind, but you can see the actions and go from there. It looks extremely unlikely that this is a case of hacking for profit or to cause harm.