>Or will his status as a security researcher (albeit one with poor judgement) protect him?

It usually doesn't protect you even if you don't take anything.

That's why there's a huge backlash against "responsible disclosure".