Bounty programs explicitly tell you to only to target accounts that belong to you. Outside of that, if you're "peeking" at information that doesn't belong to y

Bounty programs explicitly tell you to only to target accounts that belong to you. Outside of that, if you're "peeking" at information that doesn't belong to you, you immediately stop, document, and submit the report. You do not download 14,000 files as the Uber hackers did. This is a non-trivial amount of nuance that clearly shows the hackers were not acting in good faith.