> I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue

It was strictly necessary to show the extent of the problem, which will lead to less products leaving their users' data exposed.

It's true that it might lead to legal problems, but there's no doubt that they were morally in the right, and that it's the laws that might punish this that are wrong and harmful.

They downloaded data, didn't (probably) do anything bad with it, and warned everyone about the problem, while in all likelihood many criminals already took it and used it without telling anyone.

You can give people legal advice, but you can't argue that they did anything morally wrong.