The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then

The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then they later see Version Y, without the vuln, and update their vulnerability database. Nothing in the article suggests that they contact site-owners (I haven't re-read the article, so might be wrong). I'm not sure why you think it's a potential violation of CFAA to connect to a public server and probe it. There's no suggestion of unauthorized access; that would involve exploiting vulnerabilities they find, and that would be unauthorized access.