From the articles I read on this in German and this one it seems to me that there is an easy to miss point: the consultant didn't have any authorization from Modern Solutions to conduct a pentest, he was working for a Modern Solutions customer. When he discovered the hard-coded password, he should have stopped there and reported it.