Having better ways to telegraph your intentions is, as far as I'm aware, still an issue, and I would support improved/expanded methods of 'escrow' for this sort of work.
Way back in college, I talked myself into doing a white-hat hack of a service another student was running that I valued highly. He had used software with a rather nasty CERT advisory outstanding. My attempts failed, which meant he had patched his system, probably at the firewall. I shrugged and went on with life.
Or at least I tried to, because the next day I got an email from him telling me that he saw what I did and if I ever pulled shit like that again he'd report me to the Dean's Office. For the time, the university had some pretty sophisticated auditing tools to backtrack problems including shenanigans of this sort and because I was doing something 'good' I had just accessed his system straight from my dorm room (I found out shortly after that even if I had attempted to remote in he still would have been able to send that email).
I offered an "apology" that was about what you'd expect from a 20 year old white male: all excuses and rationalization. It hadn't quite sunk in yet that this distinction between black and white hat existed solely in my brain. I don't even think I bothered to tell my roommate what I was planning to do. I had zero alibi because I was impulsive. I never did anything like that again. If memory serves, I told him I'd never do something like that again (which means it was sinking in a little bit), and that has been largely true.
In hindsight, I was such an earnest kid that any decent lawyer could have would have been able to get me off with a warning, that would have saddled me with debts that would have fucked up my 20's, even if we had gotten a good rate through a family friend. I'd probably have still failed a background check on the piece of software that I worked on in my 30's that is and probably will remain one of the mantelpieces of my career.
The Venn diagram of people with a suspicious enough mind to think of trying what I did and the personality that would keep them out of big trouble is very narrow. But to your point, the circles for aptitude, desire, and history are pretty small. As it turns out, I didn't enjoy being a low-bus-number person responsible for the security of the system, so I now fall outside of the 'desire' circle. These days I'm content to help people sort out/select auth libraries, configure CA certs, and occasionally talk trash about cryptocurrency. I have enough other interests that I'm probably booked out until after retirement.