That's what happens when you compromise a site that you don't have authorization to test. You always run this risk when performing testing that isn't under the umbrella of a formal bug bounty.
Perhaps there should be some sort of bug bounty on all government (at least federal, ideally state, and in a perfect world local) sites? Would be awesome if, say, the US CTO spearheaded an effort to implement one.
Most bug bounty programs don't let you pivot and try to escalate your privileges on a live system, which is exactly what this guy did and exactly why he is in so much trouble.
Hackers are basically the 5-th branch of power and there should be equivalents of the things like FOIA and journalist protection.
You also further increase that risk when you extract data from the site, use that data, and then contact one of those in the the election running all before contacting the entity running the service.