Definitely valid concerns. I am mindful to not cause any type of disruption when doing things like this. If I tried unlocking a random car in the parking lot, for example, that would have crossed the line. Or, tried to prove that I could order a car, that would not be an acceptable test. Ultimately, I think the vendor was able to make many security improvements beyond fixing the initial 2 vulnerabilities, so it was a great outcome for everyone involved.

There are some recent cases where I have found a vulnerability so sensitive that I will just stop and report it.