If this is a security vulnerability, then these guys just documented their exploitation of said vulnerability. Sounds like a crime. Proper research would be to

If this is a security vulnerability, then these guys just documented their exploitation of said vulnerability. Sounds like a crime. Proper research would be to identify an issue, write up the issue, conduct a handful of tests, report the issue. Improper research is enumerate the entire input space and gather as much data as you can from the target.