I guess that if you work for a company you're probably not looking at anyone's website that's not explicitly paying you/your company and under some contract.
Not all specialists or researchers are doing penetration testing. Of those, not all of them are penetration testing third party stuff, and of those, not all of them are doing it without permission. That's the only one that will get you into trouble.
I'm not, technically, a "security specialist" of any stripe, but I take a very careful interest in the defensive side of security, and am currently in the middle of implementing a fairly security-sensitive system. I don't worry that the FBI is going to bust down my door at 2am because I've tweaked the API of my code to make it harder to write cross-site scripting attacks, or because I fixed the architecture so that authentication is done very early in the request cycle instead of ad-hoc and inconsistently very late in the request cycle in a way that requires every developer of every individual web page to have to enforce all authentication. Most security work is going to involve internal matters and the fixing thereto, and, yeah, the job isn't going anywhere any time soon.
(Though it does have the eternal challenge of convincing people they need to pay for it, and the problem that even in companies where programming is the major product like Facebook and Google, you're still going to be a cost center.)