A good public-benefit scam to pull would be to periodically post things like "I can't explain why yet but change your passwords IMMEDIATELY for [pick random website here, let's say Instagram], trust me I'm an infosec professional". Even if none of these corresponded to real exploits you'd get lots of people to change passwords on various websites at random, which longterm would improve the security of the entire Internet if any of those sites got coincidentally compromised a year before or after
Except many of them will forget their passwords immediately and lost control of their accounts because they don't remember how they spelled the name of their primary school. Which is the reason they never change their passwords.
Unintended consequences.
