Is it ethical for these researchers to pay hackers for access to malware before it’s unleashed?