Yeah, this is probably the right answer. Immediately protects users, and website owners would quickly find out as well. :-)

Primary obligation is to the users, not the owners of websites that got themselves infected.