Ok, then you agree that we should be protecting childrens data? So then something like a bug bounty would've been an overall plus here? Kid gets to test his skills, a new vulnerability in the system gets found, and everyone wins.
The website was vulnerable, if he didnt do it someone more malicious wouldve. They shouldve offered a bug bounty if they actually cared about the data.