It looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.
This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.
I have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.
I would like to know from the OP if they consider it harassment.
The way I read it, they mention that sadly, it is tricky to do security research without breaking the law, and breaking the law is bad for the security researcher. So I read that as an advice.
Most of the messages then are answers to the good people of HN who do not want to hear the advice, because it is sad and they don't want to accept that reality is sad? So the parent is defending their opinion against people saying "bullshit, finding a security vulnerability is a good thing, I'm absolutely sure that they would never be sued for it, because I don't want to live in a world where they would". Turns out, security researchers being sued it not unheard of.