On another note, tech crunch seems to have done research where they actually monitored information passing through. Is this an ok line to cross in security disc

On another note, tech crunch seems to have done research where they actually monitored information passing through. Is this an ok line to cross in security disclosures? It doesn't feel right. Like as soon as you know you are looking at customer data, realtime or not, you should be closing the terminal/browser/whatever and reporting it immediately. Assuming you aren't a paid for by company security researcher that is. Curious what the more canonical opinion is on this.