And that's one of the reasons if you're not a security expert and stumble upon someone's security problems, you do nothing (at least in US).
Unless lives are at stake due to the security lapse, it's pretty clear to me that the only reasonable response is to go "oh, that's interesting" and then close your browser window and never tell a soul.
edit - the folk saying that this guy was stupid for doing anything are completely irresponsible.
Naming and shaming typically gets some kind of a response. Keeping quiet does not.
I know not everyone agrees with full disclosure but I assert there is a time and a place, and after a demonstration like this one, IMO this university is one of those places.
Edit: typo