Although, not purposefully exfiltrating loads of data after you've found a vulnerability is like, ethical reporting 101. Otherwise you get situations like Uber

Although, not purposefully exfiltrating loads of data after you've found a vulnerability is like, ethical reporting 101. Otherwise you get situations like Uber paying out an enormous "bug bounty" totally-not-in-exchange for having their stolen data destroyed. If that person had simply pointed out that they had credentials published in a public repository, how much would they have been paid? Probably somewhere within an order of magnitude of the program's stated maximum payout.