Of course I would. But that doesn't mean, that I should. Look at my given movie.
And we are not even talking about lives anyway, so the only think is loosing money. I am also invested in both ETH and DAO, but still I know, that its wrong, to make a hard fork. Soft forks, can be maybe considered to put pressure on the attacker to give most of the money back.
But for finding that exploit, he has deserved some money anyway. Companies like Apple, Facebook or Google pay a lot for finding exploits...
If he didn't do it someone else would have have done it later and it would have been even worse scenario...
Yes they pay if you talk of the exploit you found directly to the company, not using it, to stole money, and then if the exploit is confirmed they pay a reward..... this is not the way to manage exploits in the right manner....