Details matter, and the examples you came up with are ridiculously off base. In this case there was a bug bounty program, so it is not as unsolicited as someon

Details matter, and the examples you came up with are ridiculously off base. In this case there was a bug bounty program, so it is not as unsolicited as someone washing your windshield at a stoplight. Secondly this is not a personal residence, thirdly the property was never broken into by the researcher (nor locks changed), finally there's is fiduciary duty from the company to their clients/users. Since you are keen on hypothetical scenarios, let me present to you a more similar scenario. A school is situated near an old tree in a nearby lot that has a risk of falling, either on the school or on the public sidewalk, the researcher notices it, rents the nearby lot and safely chops down the tree. Then sends a bill to the school for chopping down the tree. It is important to note that I didn't ask the question in order to get the opinion of strangers on what should happen based on personal ethics, rather I asked the question in case someone knowledgeable about the law knew the actual answer as to what the courts rule.