I think white hats would take a bounty for discovering a flaw.
Black Hats are another animal and play a role in the environment of predator prey on security evolution.
All are important to a strong ecosystem of trust. If a 3rd party acts as a trusted party but cannot defend that trust, it should not be trusted and should suffer the consequences, whether paying bounties or losing their business.
I lost thousands of ETH when Cryptsy exchange owner walked away with everything on exchange. Because I didn't keep records of my transactions I had no recourse.
Similarly with the Mt gox hack/wiley bot fiasco.
And then who do you return it to? The faulty exchange or the person(s) specifically affected? The arbitrator?
Dunno, what if the investigators lie and say that your coins are listed as stolen coins? Investigators lie and steal all the time like during the Silk Road debacle.
It's definitely a philosophical and then legal question, not a bitcoin protocol question.
This couple should be in jail just for making this video:
***
Coming soon:
AE Ventures - sooner than soon
*Psychedelic Retreats
*Physical and mental exercises
*Addiction services
Step 3: property found
Step 4: set date
Step 5: plan agenda for participants, food, logistics etc, integration and counseling post-experience
Step 6: long-term planning
I am amped.