If I open up the index page of some completely random website (which I have no prior contract to test), and I find myself seeing sensitive information caused by some webapp error, SQL errors for example. That should not be my problem, because I didn't intend to see it and it's not my fault.
Let's put it this way. My request is now
HTTP GET /index.php?image=../../../etc/hosts to see my favorite cat picture. Does it sound like "more illegal"?
In both cases I accessed information they were not intended to share without prior permission. So what differentiates regular browsing and looking for vulnerabilities if you technically can't know what data will be returned by the webserver?