I agree, if you're testing someone else's website or servers, you should comply with the scope and disclosure rules or not do the testing, unless the vendor has something else on their website that implicitly authorizes testing (like an email address to send reports to).

But that doesn't apply to Steam; nothing they write can really impact your ability to conduct security research on your own computer.