>> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes?

No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them.

Pointing out a vulnerability is not the same as demonstrating it.

That said, a demonstration will get their attention more.