A metaphor for you: If an individual finds that a door is unlocked, they should feel the right to search the whole house and catalog all the person's belongings?

I fully agree that there should be zero disincentives to RESPONSIBLE disclosure. Fully copying down a database, for example, to prove that there is weak authentication would not be responsible disclosure and opens the data to significantly more risk than the vulnerability alone did.