Stealing users' keys does not count as an exploit, the exploit has to be against the intent or publicly-described workings of the smart contract itself, not against the users or the blockchain.

The exploit does not have to be used (it could be just published after the vulnerability is fixed), and if it is used and the money is returned, it still counts. So whether it is developed/used by "black hats", "white hats" or "grey hats" is irrelevant.

We could see this if techniques are developed and universally used to guarantee the security of smart contracts against exploits, no new smart contracts are created, or smart contract blockchains all die.