I'm struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more t

I'm struggling to comprehend those in support of the researcher? As a security researcher myself, this is just something you do not do. There was nothing more to be gained after he had those API keys - for any other researcher its game over, you won. As far as I'm concerned anything that happens to you after that point is of your own making