What reason do you have to needing to know what a system is? Just because you think you have a password for it?
> If security finds you in a room you aren't supposed to be in, is that your fault?
It depends. Do you know you're not supposed to be in that room?
> Should you be punished?
I've run into this exact same situation three times. One was a hard coded SSH key to a root account, two were hard coded passwords.
In all three cases, I simply contacted the vendor, let them know I had this key, coordinated disclosure with them, and then told them what the password was and where I found it.
In all three cases, the disclosure was enough for them to go wide eyed, immediately understand which systems were impacted, and then quickly leave the call to go fix the problem.
There is _zero_ reason for you to _use_ exposed credentials if you find them. It adds nothing to the "security research" you may be doing.