It's more than that, if there is no consequences for this kind of action, we are going to get a wave of "security researcher" wannabes trying to pull similar bullshit.

Ps: I have put security researcher in quotes because this kind of thing is not security research, it's a publicity stunt.