I'd suggest reading tptacek's comment: https://news.ycombinator.com/item?id=37298589 which does not 100% address your exact question, but gets close. As disclaimed, tptacek is not a lawyer, but has a lot of experience in this space and I'd still take it as a first pass answer.

Personally, I don't see it as worth it to pursue a company that does not hang out some sort of public permission to poke at them. The upside is minimal and the downside significant. Note this is a descriptive statement, not a normative statement. In a perfect world... well, in a perfect world there'd be no security vulnerabilities to find, but... in a perfect world sure you'd never get in trouble for poking through and immediately backing off, but in the real world this story just happens too often. Takes all the fun right out of it. YMMV.