So he feels that if he breaks into a bank, steals the money, that he can merely tell the police/fbi that he was "merely testing, and meant no harm"?

Point in case, it went beyond "wow, look what I found by accident" into a crime. As for mentality of a tester, I'm a beta tester for Vendetta, many Opensource projects, Microsoft, Ragnarok Online (years ago), and many Ragnarok Online emulators. Many of us are beta testers and understand the limits, so we understand how to test from a beta testers point of view.

Your friend turned it into a crime the moment he realised what he was doing, and decided to continue doing it instead of reporting it.