Scanning other people's networks without their permission has no valid research purpose.
If they didn't want to accept any connections, they should've closed the port.
If they only wanted authorised users to connect, they should put an authorisation requirement on the connection.
As for your statement that there's no valid research purpose, that's your assertion, a lot of people will disagree.
Is it valid to research untreated syphilis in black men? Yes. Is it valid to research untreated syphilis in black men without their permission and informed consent? No.
The Tuskegee Syphilis Study was inappropriate because they purposely withheld information about the diagnosis and lied about the efficacy of the treatments they were giving.
The problem wasn't that they conducted the research without telling the patients. Obviously the patients were aware that they were part of a research effort, since they directly interacted with the clinicians conducting it.
How do you know? Lots of people misconfigure their systems and leave them open to access unintentionally.
Huge numbers of people have done this, I've certainly done it in the past when I knew less. Discovering that the webserver logfiles were rather larger than I expected, or that HTTP Traffic was through the roof... oh, right, I left something open, better close that and remember it for next time.
However I don't think it's a reasonable assumption that the open status of TCP ports is supposed to be private information.
We're not discussing the morals of human research, we're discussing IT security, and specifically in scenarios that are unlikely in the extreme to lead to any physical harm to people.
We're also not talking about trying to sabotage or attack a system.
Standard, well-formed web requests on standard HTTP sockets, made infrequently are very unlikely to cause problems on any system that's not outright deliberately misconfigured.
Also what is the hypothesis that is being researched or investigated by knowing how many systems on the internet respond to TCP SYNs on port 23?
Alternately, you could ask me "If a computer is broadcasting packets to my computer which is connected to a network port that I'm allowed to connect to, is it ok for me to note that?" In which case I'd say yes.
I also think that moves the analogy too far in the other direction. While it may not be the case that servers are actively "broadcasting" their port open status to all internet users, that's only because it would not be feasible to do so. It is not because port open status is supposed to be private or secret information, like the inside of my bedroom for example.
In fact TCP/IP is designed with the intention that anyone can check the port open status without authentication. It is part of the intended usage of the protocol, so presumably it is safe to assume that anyone using it is probably using it with that intention.
If it's valid to shine a laser pulse from space/the sky onto the entire surface of the Earth (private property included) to determine the elevation of everything, it's valid to send TCP SYNs out to the entire surface of the internet.