Finding a security vulnerability and reporting it does not count as a data breach, because the data has not been misplaced, misused and/or other similar activities.

However the vulnerability itself could be used to cause a data breach, but in case of someone reporting it then it's not a data breach, considering they didn't abuse the data through the vulnerability.

It's no different than your QA testing an application and noticing that there is a data leak during test etc.