Because technically the methods used (i.e. SQL injection) are illegal if you dont own the equipment your using it on.
Also he is a civilian and does not have any power or jurisdiction to do so.
Slightly off-topic: Is SQL injection itself illegal? Because I was under the impression that only using SQL injection to gain unauthorized access to someone else's computer (like the OP is suggesting) was illegal.
You can do SQLi against your own database 24x7 and you'd be just fine in the eyes of the law.