Simple rule: if you don't have the permission of the company to mess with their system, don't do it. Why would you anyway? You don't get paid and you spoil your integrity.
For Starbucks, it's GOOD. It means they're out $2 and some embarrassment instead of out millions when someone sees something is way off in the books.
All that said, I would have tested this more than once to ensure it wasn't some minor built in allowance.
Why would you help a for-profit company for free? Would they do the same for you? What is the best-possible scenario, a reward / job offer / gift certificate? What is the worst-possible scenario? Years in prison? Legal cases which drain all your savings? It hardly seems worth it to do this. Software vulnerabilities are EVERYWHERE, but trying to be a Good Samaritan in a hostile capitalistic environment doesn't tend to work out in your favor very often.
Imagine going door to door checking your neighbors' houses to see if their doors are locked. Sure, you're "helping them out" by testing for a common vulnerability, but it's very difficult to distinguish between a good samaritan and a someone with malicious intents who had second thoughts or was concerned about being caught.
They could actually be lucky to just be out a million if this had been properly exploited.
If you need the fame, use a pseudonym that consists of the same letters as your actual name and uncover the story once it cooled off or something...
He certainly didn't spoil his integrity. He had largely un-traceable riches in his hands, didn't exploit it, and gave it up. Nothing was "messed with".
The writer has admitted to a felony (several felonies, actually) in his post.
That may be a stupid law for events such as have been described, but it is the law in the United States.