I think the generally accepted practice is to go bug hunting when the organization has requested it (e.g. bug bounty programs), or report a bug if you stumble u

I think the generally accepted practice is to go bug hunting when the organization has requested it (e.g. bug bounty programs), or report a bug if you stumble upon it without really searching. Imagine going door to door checking your neighbors' houses to see if their doors are locked. Sure, you're "helping them out" by testing for a common vulnerability, but it's very difficult to distinguish between a good samaritan and a someone with malicious intents who had second thoughts or was concerned about being caught.