From a legal perspective, as far as I can tell, you're right. From a moral perspective, this only considers the well-being of the company with the security flaw. Limiting security investigations to those that have the full blessing of the company means that security flaws can be swept under the rug.