Maybe, but there is such thing as responsible disclosure.

This is a victim-blaming myth. The prime responsibility for the damage is the person who did the damage. Not the discloser, and not the victim.

Maybe, but running unauthenticated databases on the public internet is negligent at best.

No. It could be simple ignorance. Or an accident.

In your world, what is it at worst? Criminal? Capital?

Agreed that it could be either of those things. I'm not trying to excuse criminal behavior at all, rather stating that if one puts an unauthenticated database on the internet, it's going to be compromised. For software professionals, my opinion is that to do so would be negligent.

An ignorance is an excuse for compromising your company or customer's data in exactly what situations? Let's just all cover our eyes and not look, then the data will be safe I'm sure.

Of course it depends on the context. I don't know if it's reasonable to expect a small family clinic, therapist, or dental office to secure their client information. It seems that people just mass scan the internet looking for already known vulnerabilities.

However, if it's a mid-sized business handling important information, like payment information, then I do think there ought to be a standard of dutiful behavior, because otherwise who pays for the externalities?

It could also be leftover testing systems that haven't been torn down yet, with nothing interesting in them. The internet is full of them.

Why shouldn't we blame victims too? Should we not blame victims of shark attacks that swim in shark-infested waters?

Have another go at interpreting my comment.