I think maybe you're missing the significance of legally mandated redaction - continuing to provide access could well constitute a criminal offense depending on the specifics. And there may be many other reasons for redaction - as a sibling comment notes you certainly don't want to continue serving a package that contains sensitive private information.

I see the "exploit" case as a strict subset of redaction in which you do want to continue serving downloads to parties that explicitly acknowledge that they understand the classification of the artifact in question.

(Amusingly this exchange has led me to realize that as things currently stand a piece of malware can trivially be made illegal to distribute and thus extremely difficult to develop countermeasures for provided that the malware authors are willing to violate an additional law or three.)