As a researcher, it's always safer to only test online services that have a bounty program and/or researcher amnesty program in place. By virtue of having those programs, however, those companies are demonstrating a certain level of information security maturity. If your interest is in warning users of risks to their privacy, the greatest risks to it are most often found in companies who haven't quite gotten there yet. By finding the issues and reporting them to the company, they may spur them to improve. If the company is unresponsive, disclosing the issues publicly instead may motivate them to respond. We don't want that response to be a lawsuit or criminal charges when the researcher is performing a public service.

Security researchers try to call attention to security and privacy risks early. They aren't always right, but even when they're wrong, it's still beneficial for the rest of us to have them sounding their warning calls.