If you're proposing an investment of effort to find new information, it's absolutely fair game to ask what we will do with that information--how we will benefit from it.

a) We find a naturally attenuated strain and do nothing to promote or spread it.

b) We find such a strain and treat it like a vaccine candidate with all the testing.

c) We find such a strain and treat it like a vaccine candidate but without all the testing.

If someone does a) or b) they are on solid legal and scientific ground, but arguably have not created any new benefit beyond what is already happening to develop a vaccine.

Whoever does c) would certainly deliver a benefit in terms of speed... but if they cause any unexpected harm, would be exposed to legal liability.

I guess my fundamental question is whether the hard part of developing a vaccine is attenuating the virus or proving such attenuation is safe. Epidemiology can help us find natural versions of the former, but it can't help us with the latter.

Epidemiology cannot satisfy a question of safety. It can only identify risk factors, as John Snow did with the water pump. If your idea succeeds, at best we will be able to say "this strain seems to be a low risk factor for serious illness or death in this population." Then what?

The critical moment for cholera was to run an experiment: remove the pump handle and see what happens. But in the case of vaccines or vaccine-like strains, we are not talking about an experiment to remove a risk factor, we are talking about spreading a risk factor after properly qualifying its risk as low. That is much harder to do. The only way is to run a bunch of experiments.

No matter what is done or not done there is risk. This is the nature of this problem. I am of the belief that the more options you have the better. If there is an attenuated strain out that has infected a large number of people we should look for it. What we do with it if we find it is a political question, not a scientific one.