Why should we punish someone for their curiosity? Arguably, we should be punishing the school for their lax security. If a teacher left the gradebook out and a student changed their grade, the teacher would be reprimanded too.
In this case, this child knew what he was doing was wrong and continued to do so. His motivations were clearly to use the vulnerabilities in the software as a hedge to his burgeoning career in the security industry. He put people's jobs on the line and caused grave embarrassment to the school district for his own selfish motives.
Other people at that age want to be astronauts, do you yell at them if they look at the sky?
> He put people's jobs on the line
Incompetence put those people's job on the line. But given the state of that industry I find that statement unlikely.
> and caused grave embarrassment to the school district for his own selfish motives.
The kid was curious, end of story. It's not their fault that a particular industry is both used by people at a curious age and prone to be crapware insecure.
You seem to attribute some criminal motivation to this behaviour, I highly suggest you read through other threads here and hopefully come to the realization that this is normal behaviour for tech-savvy kids. Villanizing this not only leads to absolutely unnecessary problems for kids like that in school, it's a token of unproductive reactions to disclosures we see everywhere these days. These people do you a favor, a responsible disclosure by a curious party is far preferrable than real criminals exploiting them.