He doesn't actually "attack" games. He "only" discovers critical bugs, posting detailed descriptions and proof-of-concept exploits publicly without notifying the affected games' developers.
Basically he's like a cheat codes, claiming to do it for "research" and publishing his findings. The only difference is, he doesn't take any money for it and doesn't keep it as secret as the usual cheaters. And he probably doesn't actively use the exploits himself. Then again, he really doesn't have to, some script kiddies already take care of it.