> Anyone who attacks a system with the intent of causing minimal harm and reporting what they find should be protected.

Do you think that people should be allowed to penetration test your house without your permission?

At what point does a system become big enough that you think people should be allowed to attack that system - regardless of its owner’s desires - as long as the attacker has subjectively good intentions?

I am sympathetic to the idea behind your comment, but I don’t see how it’s compatible with strong private property rights. I don’t want you attacking my systems without my permission.