A security hole like this is extremely dangerous due to the magnitude of its ignorance. Systems like mass transit should HAVE good engineers that spend time evaluating security risks and testing systems for robustness et cetera.
I doubt the hole would have been patched if someone called up their local Mass Transit Authority and said "Hey, uh, I've got this 0-day..." A 14 year old boy exploiting it, on the other hand, is probably going to draw some attention to it, and that attention will likely get the hole fixed, potentially saving hundreds of lives in the future.
If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station.
If the radio station were aware that playing that song would result in loss of life, they would not play it, and would be at fault if they did, or at least in for a percentage of it.
I would ask of you whether you would apply this principle in other systems. Shall we call it a "good lesson" if the kid went around shooting people in the train, as a lesson that the trains need to be bulletproofed?
Folks, the criminal law exists to punish certain undesirable actions, so that the general public can save itself the cost of self-protection. I don't walk around wearing a bulletproof vest all the time, because I believe that the law and its enforcement will sufficiently deter others from deciding to intrude upon my body with a bullet.
So should it be with technological intrusions as well as physical. Certainly it is feasible to build secure systems. So is it feasible for me to wear a bulletproof vest all the time. But secure systems, like bulletproof vests, are costly things--they require hiring good engineers, spending time to evaluate security risks, testing systems for robustness, and so on. And if these costs are sufficiently high, then it would be economically inefficient to impose them on systems engineers by allowing hacking like this to go unpunished.
I'm not saying that anyone should be lax in building secure systems. I am, however, saying that intrusive behavior like this kid's should not be applauded. It should be recognized for what it is: a societally detrimental act, for which he should be held accountable as any other societally detrimental act is held under the law.