First, it's not your lock and not your home. It's someone else's; the fact that you have noticed that it's unlocked or defective, does not make it yours. In the communications Pillar clearly mentions that they were concerned about the size of the files with private information of their customers Webster has downloaded as a "proof". So do a little experiment: walk up to police officer on the corner, and say that there's that unlocked home across the street, and as a proof, here's what I was able to grab from that home when I entered it through the open door, because you see, I'm researcher of the quality of the locks on others' homes. Then see if you receive a medal, or something else for your discovery.
And if he indeed was a researcher, a white hat, he would know how to make it all legally, and to get paid by the same Pillar.
Hey, and thanks for the "idiot", that really invites the discussion.
I guess, the right way would be to inform Pillar that he has found a security hole in their system, without giving any details, and offer them a $10K contract for consulting services, which would include the clause of his being untouchable for whatever information he has obtained in the course of that consulting.
Corporations in general and banks in particular are natural opponents, if not enemies, of the people; assuming that they will behave according to human values is simply plain wrong. Helping them on voluntary basis is as silly and dangerous as helping the police - in both cases, while the positive outcome is quite unlikely, but your putting yourself in danger is guaranteed.