Actually, criminal copyright infringement is a $250k fine, 5 year felony, in the US. Pretty amazing. You are vastly more likely to be prosecuted criminally if you're part of a group, and especially if you focus on 0-days. Even more likely if you sell things, charge for advertising on your site, etc.
DMCA still makes some 0-day exploit research not totally safe, either. https://www.eff.org/wp/unintended-consequences-under-dmca I don't know if anyone has been successfully convicted, but a lot of prosecutions have come up, and that's enough to deter many people.
The DrinkOrDie people got a lot of 3-5 year sentences. http://en.wikipedia.org/wiki/Operation_Buccaneer