Actually I think there's no discipline when a rumor of an intentional release of a new detected virus is true and culprits go scot-free. Just like you said, culprits of such acts should always be punished to serve as a lesson to the rest that might be intending to take same step.
In as much as there might be a kind of misuse among third-party of these researches, there are still these bad researchers too that doesn't care as long as their pocket will be hefty