If you left your front door wide and I robbed you, I'd have committed a crime. There's no "but the front door was open" defense.
It would still be a crime. I would and should be chastised, but the person who robbed me should still receive a proper punishment.
Even unlocking their door with a key you found lying in the street, and then going in, is not in itself criminal (where I live). If you go on to commit a crime while inside, or did it with the intention to commit such a crime-that added fact makes it a crime (“break and enter”). But mere unlocking the door and entering in itself is not.
Not sure where you live for that to be the case, but someone coming in because I left my door open is not normal, even if I left my door open. Even if they claim they were "making sure everything was safe".
Obviously stealing is a crime and we shouldn't victim blame. But with a lot of software the business isn't much of a victim so much as their customers are, and there doesn't seem to be much incentive for companies pro-actively securing their software. You could argue in hindsight the developer would've been better off selling the vulnerability and/or data to the black market rather than reporting it.