>One those vulnerabilities are found, the hackers will pounce

...and work to exploit your code to their own benefit. They don't do this just so that they can refund your customers.

Often it's just done for reputation. "We got ahold of their stripe key and refunded everything lol" is hilarious and absolutely on-brand.

I mean, I can see refunding their customers just for the lols.

From the customers' perspective sounds ethical. The product was broken or extremely cheap quality, and not what it seemed to be originally when you decided to purchase... Is this black or white? ;p