I think it really depends on the data itself and jurisdiction. There's very real chance just having more data than you need to prove the exploit exists could open you up for potential legal liability (especially if the data itself is sensitive). Imagine a situation where the researcher gets compromised after the fact with sensitive data lingering around on their machine.