What legal protections do "security researchers" have to conduct this kind of investigation? After getting into the panel by using the admin/admin default, they

What legal protections do "security researchers" have to conduct this kind of investigation? After getting into the panel by using the admin/admin default, they continued to click around, clicked into user accounts, exposed passwords, etc. I understand the value of what they're doing (and their own internal policies to not release said data), but as far as I'm aware, there is no law that would protect them if Equifax decided to attempt to get them prosecuted under the Fraud/Abuse Act. Every time there's a big-name company in the news, all the various security firms seem to go to town seeing who can break into the rest of their systems first. Regardless of intention, it still seems potentially criminal.