This is something I don't understand. How can it be illegal to expose vulnerability without telling someone the real issue in the digital world, while having no responsibility if let's say you call a shop owner's attention that the patio's parasol might be causing injury in the physical world?

It's more like telling a shop owner that you were able to open their doors when the shop was closed by simply getting the key from under the doormat. It actually seems tricky to design law sensibly around cases like those.

These analogies never work (and I just used one elsewhere on this story too) - one could equally equate it to arriving at a business, opening the door without seeing the "closed" sign, going in and taking a photo, realising no-one is there, and leaving. Then you call the owner and say "I noticed you have a security problem". The problem is their employee forgot to lock the door, they'd indicated you shouldn't go in (posted the closed sign) and so strictly speaking you were trespassing [unlawfully entering, whatever].

Punishing the person for telling you you have a problem seems a bit silly, even if the photo they took included copyrighted material (maybe an architecture model on the counter).