If he has no malicious intent and is not going to view/sell or do anything malicious with the data, I think it’s fine or even beneficial for him to continue to

If he has no malicious intent and is not going to view/sell or do anything malicious with the data, I think it’s fine or even beneficial for him to continue to find further vulnerabilities and then report the whole package of vulnerabilities to the company. As long as he wraps it up within a few hours or say max 24 hrs and then immediately reports after that.