Good luck with that. The CFAA was written when Reagan was spooked by Wargames in 1982. If you violate any TOS of websites you use (very easy to do) it can be prosecuted as a federal felony with a maximum sentence of 25 years imprisonment.
If the police really want you to disappear into the penal system, they’ll make it happen. And they do, routinely.
IMSI catching is a different thing.
But yes, exploits are sold by gray hats rather than by white hats and closed. The NSA is supposed to be on top of this, but instead of closing exploits, they keep them to enhance their anti-terror spying, which they then trickle out to US Law Enforcement, especially if there’s loot (liquid assets) that are easy to seize.
Law enforcement in the US is mostly a highway robbery racket.