Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security

Turning the question around, if you did discover that you were able access a site, and it concerned you enough that you felt obliged to report it as a security problem, then by your own judgement you have decided you shouldn't have had access. So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.