I guess attempted murder shouldn't be prosecuted with this kind of logic.
...Or for that mater any conspiracy crime. But I tend to believe that he committed an actual crime here. If I left my back door open and you found out, came in and wrote down all my account numbers from my checkbook, whether you charged against my account or not has nothing to do with the fact that you invaded my home. Same should be said for servers. Finding an exploit is not an invitation to invade another's privacy.