Agreed. What is holding a LOT of people back from doing even kind-hearted hacking (i.e. "grayhat" activities with the purpose of helping the victim) is the fact that a criminal record can break your career entirely. Bug bounty programs only get you that far, and some I believe (I have very limited experience with bug bounty hunting) have a strict scope.
It's not worth the risk.