There a difference is finding an exploit accidentally and reporting it from running a penetration testing tool on a production server.

What did this kid expect?