Yeah but that wasn't the situation. Twas a bit late for that by the point OP discovered there existed a security issue in the first place and they had even already "exploited" it.

I think a lot of hackers start with just seeing what’s going on without any intent to dig deeper. But then something too good to pass up gets them high, and with weakened inhibitions, they make bad decisions that require responsible disclosure (in lieu of saying and doing nothing and possibly getting into more trouble). Of course a responsible disclosure is always prudent, and these companies certainly did not deserve one, but the hacker here got too excited. They didn’t cover their tracks first, necessitating a responsible disclosure.