Whether it’s negligent isn’t terribly relevant. Is it illegal? It is not, they aren’t bypassing access controls. No different than using Shodan, scanning public IPs, crawling open directories, etc.

It would be different if they were attempting to brute force credentials to access an endpoint, but they aren’t.