[nicksergeant]

In that particular case, the person was a security expert who spent time hacking (by way of URL) their system to expose information. And they threatened legal action but never went through with it (as they had no case).

In this particular case with Bank of America, a user did nothing out of the ordinary to expose information and reported it proper.

Just my 2 cents.