Why Not Both?

from here

While there's certainly some value in finding vulnerabilities, some researchers seem to think they can do no wrong in the mistaken belief that there are only 2 relevant parties in vulnerability disclosure instead of 4 (researchers, vendors, users, and attackers).

By the way, if you think this comic is about you specifically ... you could be right.