I work in the industry and if what has happened is that the site requested a test from them and was happy for them to publish this then yes I guess it's appropr

I work in the industry and if what has happened is that the site requested a test from them and was happy for them to publish this then yes I guess it's appropriate, but I wouldn't really do it as it associates the firm with hacking live sites. To put it another way, to demonstrate the exploit you have to actually conduct the attack. To find the exploit you have to do a PoC. If this was done without explicit permission from the site owner it's legally shaky ground at best and certainly (at least as far as I'm concerned) unethical.