The actual "bug" is that Facebook did not have sufficient controls in place to even detect this type of brute-force attack, much less make it impossible to attempt in the first place. Facebook seems (IN THIS INSTANCE) to have appreciated the white-hat nature of this and awarded the bug bounty, but it very well might not have. And certainly other organizations don't take nearly as friendly stances. Generally, I wouldn't bet on most organizations seeing brute-force attacks as in-scope for bug bounties - this is by no means legal advice though.

If you want to test a company look at their 'Responsible disclosure'. For example: https://www.facebook.com/whitehat

They have a bug bounty program that gives you permission to do certain kinds of things and it not be illegal since you’re planning to report anything you find (and get paid for it)